[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EV545XBYWN0XCY4AFYT6VH":3,"skill-same:01M6EV545XBYWN0XCY4AFYT6VH":116},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":77,"commitSha":78,"skillDirectory":79,"forksCount":14,"repositoryHtmlUrl":80,"repositoryHomepageUrl":81,"ownerHtmlUrl":82,"ownerBlogUrl":6,"ownerDescription":83,"updatedAt":84,"install":85,"resources":98},"01M6EV545XBYWN0XCY4AFYT6VH","implementing-ebpf-security-monitoring",null,"Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement. Covers TracingPolicy CRD authoring with kprobe\u002Ftracepoint hooks, in-kernel filtering via matchArgs\u002FmatchBinaries selectors, JSON event export, and integration with SIEM pipelines. Use when building kernel-level runtime security observability for Linux hosts or Kubernetes clusters.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-ebpf-security-monitoring\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"security","implementing ebpf security monitoring","monitoring","ebpf","siem","cybersecurity","security-operations","network","runtime-security","t1078","file access","access","aml","crd","hooks","cm","map","time","authoring","de","2026-11-10 10:12:30",false,"---\nname: implementing-ebpf-security-monitoring\ndescription: 'Implements eBPF-based security monitoring using Cilium Tetragon for\n  real-time process execution tracking, network connection observability, file access\n  auditing, and runtime enforcement. Covers TracingPolicy CRD authoring with kprobe\u002Ftracepoint\n  hooks, in-kernel filtering via matchArgs\u002FmatchBinaries selectors, JSON event export,\n  and integration with SIEM pipelines. Use when building kernel-level runtime security\n  observability for Linux hosts or Kubernetes clusters.\n\n  '\ndomain: cybersecurity\nsubdomain: security-operations\ntags:\n- ebpf\n- tetragon\n- cilium\n- runtime-security\n- observability\n- kernel-security\n- kubernetes-security\nversion: '1.0'\nauthor: mukul975\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- DE.CM-01\n- RS.MA-01\n- GV.OV-01\n- DE.AE-02\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1685.002\n- T1685.005\n---\n\n# Implementing eBPF Security Monitoring\n\n## When to Use\n\n- When deploying kernel-level runtime security monitoring on Linux hosts or Kubernetes clusters\n- When you need sub-millisecond visibility into process execution, network connections, and file access\n- When traditional userspace monitoring tools introduce unacceptable performance overhead\n- When building detection pipelines that require in-kernel filtering before events reach userspace\n- When enforcing runtime security policies (kill process, send signal) at the kernel level\n\n## Prerequisites\n\n- Linux kernel 5.3+ with BTF (BPF Type Format) support enabled\n- Kubernetes 1.24+ cluster (for Kubernetes deployment) or standalone Linux host\n- Helm 3.x installed (for Kubernetes deployment)\n- `kubectl` configured with cluster access\n- `tetra` CLI installed for local event streaming\n- Python 3.8+ with `requests`, `kubernetes`, `pyyaml` dependencies\n- Root or CAP_BPF\u002FCAP_SYS_ADMIN capabilities for eBPF program loading\n\n## Instructions\n\n### 1. Install Tetragon on Kubernetes\n\nDeploy Tetragon via Helm to get default process lifecycle observability:\n\n```bash\nhelm repo add cilium https:\u002F\u002Fhelm.cilium.io\nhelm repo update\nhelm install tetragon cilium\u002Ftetragon -n kube-system \\\n  --set tetragon.enableProcessCred=true \\\n  --set tetragon.enableProcessNs=true\n```\n\nVerify the installation:\n\n```bash\nkubectl get pods -n kube-system -l app.kubernetes.io\u002Fname=tetragon\nkubectl logs -n kube-system -l app.kubernetes.io\u002Fname=tetragon -c export-stdout -f | head -20\n```\n\n### 2. Install Tetragon on Standalone Linux\n\nFor non-Kubernetes Linux hosts, install from the tarball release:\n\n```bash\ncurl -LO https:\u002F\u002Fgithub.com\u002Fcilium\u002Ftetragon\u002Freleases\u002Flatest\u002Fdownload\u002Ftetragon-linux-amd64.tar.gz\ntar xzf tetragon-linux-amd64.tar.gz\nsudo cp tetragon \u002Fusr\u002Flocal\u002Fbin\u002F\nsudo cp tetra \u002Fusr\u002Flocal\u002Fbin\u002F\n\n# Start tetragon daemon\nsudo tetragon --btf \u002Fsys\u002Fkernel\u002Fbtf\u002Fvmlinux &\n\n# Stream events\ntetra getevents -o compact\n```\n\n### 3. Monitor Process Execution (Default)\n\nTetragon generates `process_exec` and `process_exit` events by default without any TracingPolicy:\n\n```bash\n# Stream process events in compact format\ntetra getevents -o compact\n\n# Stream in JSON for SIEM ingestion\ntetra getevents -o json | jq '.process_exec \u002F\u002F .process_exit'\n```\n\nExample `process_exec` JSON event:\n\n```json\n{\n  \"process_exec\": {\n    \"process\": {\n      \"binary\": \"\u002Fusr\u002Fbin\u002Fcurl\",\n      \"arguments\": \"https:\u002F\u002Fmalicious.example.com\u002Fpayload\",\n      \"cwd\": \"\u002Ftmp\",\n      \"uid\": 1000,\n      \"pod\": {\n        \"namespace\": \"default\",\n        \"name\": \"webapp-7b4d9f8c6-x2k9p\"\n      },\n      \"parent\": {\n        \"binary\": \"\u002Fbin\u002Fbash\",\n        \"pid\": 1234\n      }\n    }\n  }\n}\n```\n\n### 4. Author TracingPolicy for File Access Monitoring\n\nCreate a TracingPolicy CRD to monitor access to sensitive files via the `sys_openat` kprobe:\n\n```yaml\n# file-access-monitor.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: monitor-sensitive-file-access\nspec:\n  kprobes:\n    - call: \"fd_install\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"int\"\n        - index: 1\n          type: \"file\"\n      selectors:\n        - matchArgs:\n            - index: 1\n              operator: \"Prefix\"\n              values:\n                - \"\u002Fetc\u002Fshadow\"\n                - \"\u002Fetc\u002Fpasswd\"\n                - \"\u002Fetc\u002Fsudoers\"\n                - \"\u002Froot\u002F.ssh\u002F\"\n                - \"\u002Fetc\u002Fkubernetes\u002Fpki\u002F\"\n          matchActions:\n            - action: Post\n```\n\nApply and observe:\n\n```bash\nkubectl apply -f file-access-monitor.yaml\ntetra getevents -o compact --process-filter \"event_set:PROCESS_KPROBE\"\n```\n\n### 5. Author TracingPolicy for Network Connection Monitoring\n\nMonitor outbound TCP connections using the `tcp_connect` kprobe:\n\n```yaml\n# network-monitor.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: monitor-tcp-connections\nspec:\n  kprobes:\n    - call: \"tcp_connect\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"sock\"\n      selectors:\n        - matchActions:\n            - action: Post\n```\n\n### 6. Author TracingPolicy for Privilege Escalation Detection\n\nDetect setuid\u002Fsetgid calls that may indicate privilege escalation:\n\n```yaml\n# privilege-escalation-detect.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: detect-privilege-escalation\nspec:\n  kprobes:\n    - call: \"__sys_setuid\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"int\"\n      selectors:\n        - matchArgs:\n            - index: 0\n              operator: \"Equal\"\n              values:\n                - \"0\"\n          matchActions:\n            - action: Post\n    - call: \"commit_creds\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"cred\"\n      selectors:\n        - matchActions:\n            - action: Post\n```\n\n### 7. Runtime Enforcement with Sigkill Action\n\nBlock unauthorized binary execution by killing the process in-kernel:\n\n```yaml\n# enforce-binary-allowlist.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: enforce-no-crypto-miners\nspec:\n  kprobes:\n    - call: \"sys_execve\"\n      syscall: true\n      args:\n        - index: 0\n          type: \"string\"\n      selectors:\n        - matchArgs:\n            - index: 0\n              operator: \"Postfix\"\n              values:\n                - \"xmrig\"\n                - \"minerd\"\n                - \"cpuminer\"\n                - \"cryptonight\"\n          matchActions:\n            - action: Sigkill\n```\n\n### 8. Export Events to SIEM\n\nConfigure Tetragon to export JSON events to a file sink for Fluentd\u002FFilebeat\u002FVector ingestion:\n\n```bash\n# Helm values for file export\nhelm upgrade tetragon cilium\u002Ftetragon -n kube-system \\\n  --set tetragon.exportFilename=\u002Fvar\u002Flog\u002Ftetragon\u002Ftetragon.log \\\n  --set tetragon.exportFileMaxSizeMB=100 \\\n  --set tetragon.exportFileMaxBackups=5\n```\n\nThen configure your log shipper (e.g., Filebeat) to tail `\u002Fvar\u002Flog\u002Ftetragon\u002Ftetragon.log` and send to your SIEM.\n\n### 9. Kubernetes-Aware Namespace Filtering\n\nUse `TracingPolicyNamespaced` to scope monitoring to specific namespaces:\n\n```yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicyNamespaced\nmetadata:\n  name: monitor-production-file-access\n  namespace: production\nspec:\n  kprobes:\n    - call: \"fd_install\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"int\"\n        - index: 1\n          type: \"file\"\n      selectors:\n        - matchArgs:\n            - index: 1\n              operator: \"Prefix\"\n              values:\n                - \"\u002Fetc\u002Fshadow\"\n                - \"\u002Fetc\u002Fpasswd\"\n```\n\n## Examples\n\n### Detect Reverse Shell Connections\n\n```yaml\n# reverse-shell-detect.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: detect-reverse-shells\nspec:\n  kprobes:\n    - call: \"tcp_connect\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"sock\"\n      selectors:\n        - matchBinaries:\n            - operator: \"In\"\n              values:\n                - \"\u002Fbin\u002Fbash\"\n                - \"\u002Fbin\u002Fsh\"\n                - \"\u002Fusr\u002Fbin\u002Fpython3\"\n                - \"\u002Fusr\u002Fbin\u002Fperl\"\n                - \"\u002Fusr\u002Fbin\u002Fnc\"\n                - \"\u002Fusr\u002Fbin\u002Fncat\"\n          matchActions:\n            - action: Post\n```\n\n### Monitor Container Escape Attempts\n\n```yaml\n# container-escape-detect.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: detect-container-escape\nspec:\n  kprobes:\n    - call: \"sys_openat\"\n      syscall: true\n      args:\n        - index: 0\n          type: \"int\"\n        - index: 1\n          type: \"string\"\n      selectors:\n        - matchArgs:\n            - index: 1\n              operator: \"Prefix\"\n              values:\n                - \"\u002Fproc\u002F1\u002Froot\"\n                - \"\u002Fproc\u002F1\u002Fns\"\n                - \"\u002Fsys\u002Fkernel\u002Fsecurity\"\n                - \"\u002Fproc\u002Fsysrq-trigger\"\n          matchActions:\n            - action: Post\n    - call: \"sys_mount\"\n      syscall: true\n      args:\n        - index: 0\n          type: \"string\"\n        - index: 1\n          type: \"string\"\n        - index: 2\n          type: \"string\"\n      selectors:\n        - matchActions:\n            - action: Post\n```\n\n### Full Event Pipeline: Tetragon to Elasticsearch\n\n```bash\n# Use tetra CLI to pipe events through jq into Elasticsearch\ntetra getevents -o json | jq -c 'select(.process_kprobe != null)' | \\\n  while IFS= read -r line; do\n    curl -s -X POST \"http:\u002F\u002Felasticsearch:9200\u002Ftetragon-events\u002F_doc\" \\\n      -H \"Content-Type: application\u002Fjson\" \\\n      -d \"$line\"\n  done\n```\n","# Implementing eBPF Security Monitoring\n\n## When to Use\n\n- When deploying kernel-level runtime security monitoring on Linux hosts or Kubernetes clusters\n- When you need sub-millisecond visibility into process execution, network connections, and file access\n- When traditional userspace monitoring tools introduce unacceptable performance overhead\n- When building detection pipelines that require in-kernel filtering before events reach userspace\n- When enforcing runtime security policies (kill process, send signal) at the kernel level\n\n## Prerequisites\n\n- Linux kernel 5.3+ with BTF (BPF Type Format) support enabled\n- Kubernetes 1.24+ cluster (for Kubernetes deployment) or standalone Linux host\n- Helm 3.x installed (for Kubernetes deployment)\n- `kubectl` configured with cluster access\n- `tetra` CLI installed for local event streaming\n- Python 3.8+ with `requests`, `kubernetes`, `pyyaml` dependencies\n- Root or CAP_BPF\u002FCAP_SYS_ADMIN capabilities for eBPF program loading\n\n## Instructions\n\n### 1. Install Tetragon on Kubernetes\n\nDeploy Tetragon via Helm to get default process lifecycle observability:\n\n```bash\nhelm repo add cilium https:\u002F\u002Fhelm.cilium.io\nhelm repo update\nhelm install tetragon cilium\u002Ftetragon -n kube-system \\\n  --set tetragon.enableProcessCred=true \\\n  --set tetragon.enableProcessNs=true\n```\n\nVerify the installation:\n\n```bash\nkubectl get pods -n kube-system -l app.kubernetes.io\u002Fname=tetragon\nkubectl logs -n kube-system -l app.kubernetes.io\u002Fname=tetragon -c export-stdout -f | head -20\n```\n\n### 2. Install Tetragon on Standalone Linux\n\nFor non-Kubernetes Linux hosts, install from the tarball release:\n\n```bash\ncurl -LO https:\u002F\u002Fgithub.com\u002Fcilium\u002Ftetragon\u002Freleases\u002Flatest\u002Fdownload\u002Ftetragon-linux-amd64.tar.gz\ntar xzf tetragon-linux-amd64.tar.gz\nsudo cp tetragon \u002Fusr\u002Flocal\u002Fbin\u002F\nsudo cp tetra \u002Fusr\u002Flocal\u002Fbin\u002F\n\n# Start tetragon daemon\nsudo tetragon --btf \u002Fsys\u002Fkernel\u002Fbtf\u002Fvmlinux &\n\n# Stream events\ntetra getevents -o compact\n```\n\n### 3. Monitor Process Execution (Default)\n\nTetragon generates `process_exec` and `process_exit` events by default without any TracingPolicy:\n\n```bash\n# Stream process events in compact format\ntetra getevents -o compact\n\n# Stream in JSON for SIEM ingestion\ntetra getevents -o json | jq '.process_exec \u002F\u002F .process_exit'\n```\n\nExample `process_exec` JSON event:\n\n```json\n{\n  \"process_exec\": {\n    \"process\": {\n      \"binary\": \"\u002Fusr\u002Fbin\u002Fcurl\",\n      \"arguments\": \"https:\u002F\u002Fmalicious.example.com\u002Fpayload\",\n      \"cwd\": \"\u002Ftmp\",\n      \"uid\": 1000,\n      \"pod\": {\n        \"namespace\": \"default\",\n        \"name\": \"webapp-7b4d9f8c6-x2k9p\"\n      },\n      \"parent\": {\n        \"binary\": \"\u002Fbin\u002Fbash\",\n        \"pid\": 1234\n      }\n    }\n  }\n}\n```\n\n### 4. Author TracingPolicy for File Access Monitoring\n\nCreate a TracingPolicy CRD to monitor access to sensitive files via the `sys_openat` kprobe:\n\n```yaml\n# file-access-monitor.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: monitor-sensitive-file-access\nspec:\n  kprobes:\n    - call: \"fd_install\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"int\"\n        - index: 1\n          type: \"file\"\n      selectors:\n        - matchArgs:\n            - index: 1\n              operator: \"Prefix\"\n              values:\n                - \"\u002Fetc\u002Fshadow\"\n                - \"\u002Fetc\u002Fpasswd\"\n                - \"\u002Fetc\u002Fsudoers\"\n                - \"\u002Froot\u002F.ssh\u002F\"\n                - \"\u002Fetc\u002Fkubernetes\u002Fpki\u002F\"\n          matchActions:\n            - action: Post\n```\n\nApply and observe:\n\n```bash\nkubectl apply -f file-access-monitor.yaml\ntetra getevents -o compact --process-filter \"event_set:PROCESS_KPROBE\"\n```\n\n### 5. Author TracingPolicy for Network Connection Monitoring\n\nMonitor outbound TCP connections using the `tcp_connect` kprobe:\n\n```yaml\n# network-monitor.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: monitor-tcp-connections\nspec:\n  kprobes:\n    - call: \"tcp_connect\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"sock\"\n      selectors:\n        - matchActions:\n            - action: Post\n```\n\n### 6. Author TracingPolicy for Privilege Escalation Detection\n\nDetect setuid\u002Fsetgid calls that may indicate privilege escalation:\n\n```yaml\n# privilege-escalation-detect.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: detect-privilege-escalation\nspec:\n  kprobes:\n    - call: \"__sys_setuid\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"int\"\n      selectors:\n        - matchArgs:\n            - index: 0\n              operator: \"Equal\"\n              values:\n                - \"0\"\n          matchActions:\n            - action: Post\n    - call: \"commit_creds\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"cred\"\n      selectors:\n        - matchActions:\n            - action: Post\n```\n\n### 7. Runtime Enforcement with Sigkill Action\n\nBlock unauthorized binary execution by killing the process in-kernel:\n\n```yaml\n# enforce-binary-allowlist.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: enforce-no-crypto-miners\nspec:\n  kprobes:\n    - call: \"sys_execve\"\n      syscall: true\n      args:\n        - index: 0\n          type: \"string\"\n      selectors:\n        - matchArgs:\n            - index: 0\n              operator: \"Postfix\"\n              values:\n                - \"xmrig\"\n                - \"minerd\"\n                - \"cpuminer\"\n                - \"cryptonight\"\n          matchActions:\n            - action: Sigkill\n```\n\n### 8. Export Events to SIEM\n\nConfigure Tetragon to export JSON events to a file sink for Fluentd\u002FFilebeat\u002FVector ingestion:\n\n```bash\n# Helm values for file export\nhelm upgrade tetragon cilium\u002Ftetragon -n kube-system \\\n  --set tetragon.exportFilename=\u002Fvar\u002Flog\u002Ftetragon\u002Ftetragon.log \\\n  --set tetragon.exportFileMaxSizeMB=100 \\\n  --set tetragon.exportFileMaxBackups=5\n```\n\nThen configure your log shipper (e.g., Filebeat) to tail `\u002Fvar\u002Flog\u002Ftetragon\u002Ftetragon.log` and send to your SIEM.\n\n### 9. Kubernetes-Aware Namespace Filtering\n\nUse `TracingPolicyNamespaced` to scope monitoring to specific namespaces:\n\n```yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicyNamespaced\nmetadata:\n  name: monitor-production-file-access\n  namespace: production\nspec:\n  kprobes:\n    - call: \"fd_install\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"int\"\n        - index: 1\n          type: \"file\"\n      selectors:\n        - matchArgs:\n            - index: 1\n              operator: \"Prefix\"\n              values:\n                - \"\u002Fetc\u002Fshadow\"\n                - \"\u002Fetc\u002Fpasswd\"\n```\n\n## Examples\n\n### Detect Reverse Shell Connections\n\n```yaml\n# reverse-shell-detect.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: detect-reverse-shells\nspec:\n  kprobes:\n    - call: \"tcp_connect\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"sock\"\n      selectors:\n        - matchBinaries:\n            - operator: \"In\"\n              values:\n                - \"\u002Fbin\u002Fbash\"\n                - \"\u002Fbin\u002Fsh\"\n                - \"\u002Fusr\u002Fbin\u002Fpython3\"\n                - \"\u002Fusr\u002Fbin\u002Fperl\"\n                - \"\u002Fusr\u002Fbin\u002Fnc\"\n                - \"\u002Fusr\u002Fbin\u002Fncat\"\n          matchActions:\n            - action: Post\n```\n\n### Monitor Container Escape Attempts\n\n```yaml\n# container-escape-detect.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: detect-container-escape\nspec:\n  kprobes:\n    - call: \"sys_openat\"\n      syscall: true\n      args:\n        - index: 0\n          type: \"int\"\n        - index: 1\n          type: \"string\"\n      selectors:\n        - matchArgs:\n            - index: 1\n              operator: \"Prefix\"\n              values:\n                - \"\u002Fproc\u002F1\u002Froot\"\n                - \"\u002Fproc\u002F1\u002Fns\"\n                - \"\u002Fsys\u002Fkernel\u002Fsecurity\"\n                - \"\u002Fproc\u002Fsysrq-trigger\"\n          matchActions:\n            - action: Post\n    - call: \"sys_mount\"\n      syscall: true\n      args:\n        - index: 0\n          type: \"string\"\n        - index: 1\n          type: \"string\"\n        - index: 2\n          type: \"string\"\n      selectors:\n        - matchActions:\n            - action: Post\n```\n\n### Full Event Pipeline: Tetragon to Elasticsearch\n\n```bash\n# Use tetra CLI to pipe events through jq into Elasticsearch\ntetra getevents -o json | jq -c 'select(.process_kprobe != null)' | \\\n  while IFS= read -r line; do\n    curl -s -X POST \"http:\u002F\u002Felasticsearch:9200\u002Ftetragon-events\u002F_doc\" \\\n      -H \"Content-Type: application\u002Fjson\" \\\n      -d \"$line\"\n  done\n```\n",{"name":5,"tags":49,"author":55,"domain":29,"license":15,"version":56,"nist_csf":57,"subdomain":30,"description":62,"nist_ai_rmf":63,"mitre_attack":67,"atlas_techniques":73},[27,50,51,32,52,53,54],"tetragon","cilium","observability","kernel-security","kubernetes-security","mukul975","1.0",[58,59,60,61],"DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02","Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement. Covers TracingPolicy CRD authoring with kprobe\u002Ftracepoint hooks, in-kernel filtering via matchArgs\u002FmatchBinaries selectors, JSON event export, and integration with SIEM pipelines. Use when building kernel-level runtime security observability for Linux hosts or Kubernetes clusters.\n",[64,65,66],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[68,69,70,71,72],"T1078","T1190","T1059","T1685.002","T1685.005",[74,75,76],"AML.T0070","AML.T0066","AML.T0082","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fimplementing-ebpf-security-monitoring","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":86,"prompt":96,"zipAvailable":97},[87,90,93],{"tool":88,"command":89},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill implementing-ebpf-security-monitoring",{"tool":91,"command":92},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill implementing-ebpf-security-monitoring",{"tool":94,"command":95},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill implementing-ebpf-security-monitoring","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-ebpf-security-monitoring\u002FSKILL.md",true,[99,104,110],{"path":100,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-ebpf-security-monitoring\u002FLICENSE",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fapi-reference.md","REFERENCE","参考文档",5489,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-ebpf-security-monitoring\u002Freferences\u002Fapi-reference.md",{"path":111,"resourceType":112,"resourceTypeDesc":113,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fagent.py","SCRIPT","脚本",27170,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-ebpf-security-monitoring\u002Fscripts\u002Fagent.py",[117,158,167,176,198,226],{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":138,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[124,127,130,133],{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":131,"categoryName":132,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":134,"categoryName":135,"taxonomyType":136,"taxonomyTypeDesc":137},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[119,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":159,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":166,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[162,163,164,165],{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":131,"categoryName":132,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":134,"categoryName":135,"taxonomyType":136,"taxonomyTypeDesc":137},[119,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157],{"skillNo":168,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":175,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[171,172,173,174],{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":131,"categoryName":132,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":134,"categoryName":135,"taxonomyType":136,"taxonomyTypeDesc":137},[119,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157],{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[183,184,185,186,187,188,189,190,191,192,193,194,195,196,197],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":207,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[204],{"categoryNo":205,"categoryName":206,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[208,209,210,211,212,213,214,215,216,217,218,150,151,219,220,221,222,223,224,225],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":227,"name":228,"nameZh":6,"description":229,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":121,"licenseFileUrl":6,"sourceHtmlUrl":230,"categories":231,"keywords":242,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[232,235,238,239],{"categoryNo":233,"categoryName":234,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":236,"categoryName":237,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":205,"categoryName":206,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":240,"categoryName":241,"taxonomyType":136,"taxonomyTypeDesc":137},"01JBSEEDCAT000000000000036","内容创作者",[243,244,245,246,247,248,249,250,147,35,150,151,152,251,252,253,254,255,197,256],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","proposals","Academic","requirements","formatting","journal","chi"]