Like Falco, Tetragon leverages eBPF for deep system insights, but it takes a slightly different approach. It is a project developed by the Cilium community that offers real-time security observability for Kubernetes environments. It detects key events like process execution, system call activities, network and file I/O operations and advanced kernel-level monitoring. It goes beyond detecting threats and even blocks suspicious operations at the kernel level to safeguard your system.
In this video, we'll cover:
- Overview of Tetragon
- How Tetragon is different from Falco
- Advanced tracing policies like KProbes, Uprobes, and Tracepoints
- Custom event hooks
- Event and log filtering to reduce data noise
-----------------------------
π Chapters π
00:00 Introduction
01:07 Overview of Tetragon
11:30 How the tracing policy works with Tetragon
18:39 Observing Tetragon's health and performance
21:45 Conclusion
-----------------------------
π Additional Links
Hands-on tutorial
Tetragon
Tetragon export field
TracingPollicy type
Tetragon Metrics
Blog
-----------------------------
Subscribe to our YT channel
Stay up-to-date with Dynatrace! Follow us on Facebook, Instagram, LinkedIn, Twitter, Twitch
