ebpf

Four open-source tools, four different questions: what happened, what is the state now, is this behaviour forbidden, and can the kernel stop it. Choosing well starts with knowing which question each answers.

Process creation with full command line and parentage answers more questions than any other event. The rest of the answer is about the next five sources, how sensors collect them, and what attackers do to blind them.

Design-time controls decide what an agent may do. Runtime protection watches what it actually does, at four different layers, and each layer catches something the others miss.