Security Observability with eBPF

Chapter 3. Security Observability

Security observability is an essential tool in your security arsenal. Without it, you can’t quantify a metric to represent the objective security properties of a system. Security investigations depend on retroactive data, and the only way to have data is to proactively collect it. Security observability is the only record you have.

But what core security events should you monitor? What events translate into actionable signals for your security team?

The Four Golden Signals of Security Observability

SRE defines four golden signals for monitoring distributed systems.¹ Similarly, we define the four golden signals of container security observability as process execution, network sockets (TCP, UDP, and Unix), file access, and layer 7 network identity. Collectively, these data points provide crucial information of what occurred during the lifecycle of containers to detect a breach, identify compromised systems, understand the impact of the breach, and remediate affected systems.² As shown in Figure 3-1, eBPF provides full insights into the four golden signals of security observability.

Figure 3-1. eBPF collection points for a process, correlated by the exec_id value

With the help of the open source eBPF-based tool Cilium Tetragon, each of the security observability signals can be observed and exported to user-space as JSON events.

Cilium Tetragon ...