[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7EMCP1FDVT6M9CEYANCF66P":3,"skill-same:01M7EMCP1FDVT6M9CEYANCF66P":84},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":59,"repositoryHtmlUrl":60,"repositoryHomepageUrl":6,"ownerHtmlUrl":61,"ownerBlogUrl":6,"ownerDescription":62,"updatedAt":63,"install":64,"resources":77},"01M7EMCP1FDVT6M9CEYANCF66P","implementing-ebpf-security-monitoring",null,"Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement. Covers TracingPolicy CRD authoring with kprobe\u002Ftracepoint hooks, in-kernel filtering via matchArgs\u002FmatchBinaries selectors, JSON event export, and integration with SIEM pipelines. Use when building kernel-level runtime security observability for Linux hosts or Kubernetes clusters.","lza6\u002FArmor-piercing-system-prompts","lza6","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F128880206?v=4","01M7EB3K7WPX5T28EJ2NVHE6EG","Chinese-tingfeng","01M7EB3K97E1KQ16QWKJMFNGX8",11,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F04-安全渗透\u002Fimplementing-ebpf-security-monitoring\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: implementing-ebpf-security-monitoring\ndescription: 'Implements eBPF-based security monitoring using Cilium Tetragon for\n  real-time process execution tracking, network connection observability, file access\n  auditing, and runtime enforcement. Covers TracingPolicy CRD authoring with kprobe\u002Ftracepoint\n  hooks, in-kernel filtering via matchArgs\u002FmatchBinaries selectors, JSON event export,\n  and integration with SIEM pipelines. Use when building kernel-level runtime security\n  observability for Linux hosts or Kubernetes clusters.\n\n  '\ndomain: cybersecurity\nsubdomain: security-operations\ntags:\n- ebpf\n- tetragon\n- cilium\n- runtime-security\n- observability\n- kernel-security\n- kubernetes-security\nversion: '1.0'\nauthor: mukul975\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- DE.CM-01\n- RS.MA-01\n- GV.OV-01\n- DE.AE-02\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1685.002\n- T1685.005\n---\n\n# Implementing eBPF Security Monitoring\n\n## When to Use\n\n- When deploying kernel-level runtime security monitoring on Linux hosts or Kubernetes clusters\n- When you need sub-millisecond visibility into process execution, network connections, and file access\n- When traditional userspace monitoring tools introduce unacceptable performance overhead\n- When building detection pipelines that require in-kernel filtering before events reach userspace\n- When enforcing runtime security policies (kill process, send signal) at the kernel level\n\n## Prerequisites\n\n- Linux kernel 5.3+ with BTF (BPF Type Format) support enabled\n- Kubernetes 1.24+ cluster (for Kubernetes deployment) or standalone Linux host\n- Helm 3.x installed (for Kubernetes deployment)\n- `kubectl` configured with cluster access\n- `tetra` CLI installed for local event streaming\n- Python 3.8+ with `requests`, `kubernetes`, `pyyaml` dependencies\n- Root or CAP_BPF\u002FCAP_SYS_ADMIN capabilities for eBPF program loading\n\n## Instructions\n\n### 1. Install Tetragon on Kubernetes\n\nDeploy Tetragon via Helm to get default process lifecycle observability:\n\n```bash\nhelm repo add cilium https:\u002F\u002Fhelm.cilium.io\nhelm repo update\nhelm install tetragon cilium\u002Ftetragon -n kube-system \\\n  --set tetragon.enableProcessCred=true \\\n  --set tetragon.enableProcessNs=true\n```\n\nVerify the installation:\n\n```bash\nkubectl get pods -n kube-system -l app.kubernetes.io\u002Fname=tetragon\nkubectl logs -n kube-system -l app.kubernetes.io\u002Fname=tetragon -c export-stdout -f | head -20\n```\n\n### 2. Install Tetragon on Standalone Linux\n\nFor non-Kubernetes Linux hosts, install from the tarball release:\n\n```bash\ncurl -LO https:\u002F\u002Fgithub.com\u002Fcilium\u002Ftetragon\u002Freleases\u002Flatest\u002Fdownload\u002Ftetragon-linux-amd64.tar.gz\ntar xzf tetragon-linux-amd64.tar.gz\nsudo cp tetragon \u002Fusr\u002Flocal\u002Fbin\u002F\nsudo cp tetra \u002Fusr\u002Flocal\u002Fbin\u002F\n\n# Start tetragon daemon\nsudo tetragon --btf \u002Fsys\u002Fkernel\u002Fbtf\u002Fvmlinux &\n\n# Stream events\ntetra getevents -o compact\n```\n\n### 3. Monitor Process Execution (Default)\n\nTetragon generates `process_exec` and `process_exit` events by default without any TracingPolicy:\n\n```bash\n# Stream process events in compact format\ntetra getevents -o compact\n\n# Stream in JSON for SIEM ingestion\ntetra getevents -o json | jq '.process_exec \u002F\u002F .process_exit'\n```\n\nExample `process_exec` JSON event:\n\n```json\n{\n  \"process_exec\": {\n    \"process\": {\n      \"binary\": \"\u002Fusr\u002Fbin\u002Fcurl\",\n      \"arguments\": \"https:\u002F\u002Fmalicious.example.com\u002Fpayload\",\n      \"cwd\": \"\u002Ftmp\",\n      \"uid\": 1000,\n      \"pod\": {\n        \"namespace\": \"default\",\n        \"name\": \"webapp-7b4d9f8c6-x2k9p\"\n      },\n      \"parent\": {\n        \"binary\": \"\u002Fbin\u002Fbash\",\n        \"pid\": 1234\n      }\n    }\n  }\n}\n```\n\n### 4. Author TracingPolicy for File Access Monitoring\n\nCreate a TracingPolicy CRD to monitor access to sensitive files via the `sys_openat` kprobe:\n\n```yaml\n# file-access-monitor.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: monitor-sensitive-file-access\nspec:\n  kprobes:\n    - call: \"fd_install\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"int\"\n        - index: 1\n          type: \"file\"\n      selectors:\n        - matchArgs:\n            - index: 1\n              operator: \"Prefix\"\n              values:\n                - \"\u002Fetc\u002Fshadow\"\n                - \"\u002Fetc\u002Fpasswd\"\n                - \"\u002Fetc\u002Fsudoers\"\n                - \"\u002Froot\u002F.ssh\u002F\"\n                - \"\u002Fetc\u002Fkubernetes\u002Fpki\u002F\"\n          matchActions:\n            - action: Post\n```\n\nApply and observe:\n\n```bash\nkubectl apply -f file-access-monitor.yaml\ntetra getevents -o compact --process-filter \"event_set:PROCESS_KPROBE\"\n```\n\n### 5. Author TracingPolicy for Network Connection Monitoring\n\nMonitor outbound TCP connections using the `tcp_connect` kprobe:\n\n```yaml\n# network-monitor.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: monitor-tcp-connections\nspec:\n  kprobes:\n    - call: \"tcp_connect\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"sock\"\n      selectors:\n        - matchActions:\n            - action: Post\n```\n\n### 6. Author TracingPolicy for Privilege Escalation Detection\n\nDetect setuid\u002Fsetgid calls that may indicate privilege escalation:\n\n```yaml\n# privilege-escalation-detect.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: detect-privilege-escalation\nspec:\n  kprobes:\n    - call: \"__sys_setuid\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"int\"\n      selectors:\n        - matchArgs:\n            - index: 0\n              operator: \"Equal\"\n              values:\n                - \"0\"\n          matchActions:\n            - action: Post\n    - call: \"commit_creds\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"cred\"\n      selectors:\n        - matchActions:\n            - action: Post\n```\n\n### 7. Runtime Enforcement with Sigkill Action\n\nBlock unauthorized binary execution by killing the process in-kernel:\n\n```yaml\n# enforce-binary-allowlist.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: enforce-no-crypto-miners\nspec:\n  kprobes:\n    - call: \"sys_execve\"\n      syscall: true\n      args:\n        - index: 0\n          type: \"string\"\n      selectors:\n        - matchArgs:\n            - index: 0\n              operator: \"Postfix\"\n              values:\n                - \"xmrig\"\n                - \"minerd\"\n                - \"cpuminer\"\n                - \"cryptonight\"\n          matchActions:\n            - action: Sigkill\n```\n\n### 8. Export Events to SIEM\n\nConfigure Tetragon to export JSON events to a file sink for Fluentd\u002FFilebeat\u002FVector ingestion:\n\n```bash\n# Helm values for file export\nhelm upgrade tetragon cilium\u002Ftetragon -n kube-system \\\n  --set tetragon.exportFilename=\u002Fvar\u002Flog\u002Ftetragon\u002Ftetragon.log \\\n  --set tetragon.exportFileMaxSizeMB=100 \\\n  --set tetragon.exportFileMaxBackups=5\n```\n\nThen configure your log shipper (e.g., Filebeat) to tail `\u002Fvar\u002Flog\u002Ftetragon\u002Ftetragon.log` and send to your SIEM.\n\n### 9. Kubernetes-Aware Namespace Filtering\n\nUse `TracingPolicyNamespaced` to scope monitoring to specific namespaces:\n\n```yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicyNamespaced\nmetadata:\n  name: monitor-production-file-access\n  namespace: production\nspec:\n  kprobes:\n    - call: \"fd_install\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"int\"\n        - index: 1\n          type: \"file\"\n      selectors:\n        - matchArgs:\n            - index: 1\n              operator: \"Prefix\"\n              values:\n                - \"\u002Fetc\u002Fshadow\"\n                - \"\u002Fetc\u002Fpasswd\"\n```\n\n## Examples\n\n### Detect Reverse Shell Connections\n\n```yaml\n# reverse-shell-detect.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: detect-reverse-shells\nspec:\n  kprobes:\n    - call: \"tcp_connect\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"sock\"\n      selectors:\n        - matchBinaries:\n            - operator: \"In\"\n              values:\n                - \"\u002Fbin\u002Fbash\"\n                - \"\u002Fbin\u002Fsh\"\n                - \"\u002Fusr\u002Fbin\u002Fpython3\"\n                - \"\u002Fusr\u002Fbin\u002Fperl\"\n                - \"\u002Fusr\u002Fbin\u002Fnc\"\n                - \"\u002Fusr\u002Fbin\u002Fncat\"\n          matchActions:\n            - action: Post\n```\n\n### Monitor Container Escape Attempts\n\n```yaml\n# container-escape-detect.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: detect-container-escape\nspec:\n  kprobes:\n    - call: \"sys_openat\"\n      syscall: true\n      args:\n        - index: 0\n          type: \"int\"\n        - index: 1\n          type: \"string\"\n      selectors:\n        - matchArgs:\n            - index: 1\n              operator: \"Prefix\"\n              values:\n                - \"\u002Fproc\u002F1\u002Froot\"\n                - \"\u002Fproc\u002F1\u002Fns\"\n                - \"\u002Fsys\u002Fkernel\u002Fsecurity\"\n                - \"\u002Fproc\u002Fsysrq-trigger\"\n          matchActions:\n            - action: Post\n    - call: \"sys_mount\"\n      syscall: true\n      args:\n        - index: 0\n          type: \"string\"\n        - index: 1\n          type: \"string\"\n        - index: 2\n          type: \"string\"\n      selectors:\n        - matchActions:\n            - action: Post\n```\n\n### Full Event Pipeline: Tetragon to Elasticsearch\n\n```bash\n# Use tetra CLI to pipe events through jq into Elasticsearch\ntetra getevents -o json | jq -c 'select(.process_kprobe != null)' | \\\n  while IFS= read -r line; do\n    curl -s -X POST \"http:\u002F\u002Felasticsearch:9200\u002Ftetragon-events\u002F_doc\" \\\n      -H \"Content-Type: application\u002Fjson\" \\\n      -d \"$line\"\n  done\n```\n","# Implementing eBPF Security Monitoring\n\n## When to Use\n\n- When deploying kernel-level runtime security monitoring on Linux hosts or Kubernetes clusters\n- When you need sub-millisecond visibility into process execution, network connections, and file access\n- When traditional userspace monitoring tools introduce unacceptable performance overhead\n- When building detection pipelines that require in-kernel filtering before events reach userspace\n- When enforcing runtime security policies (kill process, send signal) at the kernel level\n\n## Prerequisites\n\n- Linux kernel 5.3+ with BTF (BPF Type Format) support enabled\n- Kubernetes 1.24+ cluster (for Kubernetes deployment) or standalone Linux host\n- Helm 3.x installed (for Kubernetes deployment)\n- `kubectl` configured with cluster access\n- `tetra` CLI installed for local event streaming\n- Python 3.8+ with `requests`, `kubernetes`, `pyyaml` dependencies\n- Root or CAP_BPF\u002FCAP_SYS_ADMIN capabilities for eBPF program loading\n\n## Instructions\n\n### 1. Install Tetragon on Kubernetes\n\nDeploy Tetragon via Helm to get default process lifecycle observability:\n\n```bash\nhelm repo add cilium https:\u002F\u002Fhelm.cilium.io\nhelm repo update\nhelm install tetragon cilium\u002Ftetragon -n kube-system \\\n  --set tetragon.enableProcessCred=true \\\n  --set tetragon.enableProcessNs=true\n```\n\nVerify the installation:\n\n```bash\nkubectl get pods -n kube-system -l app.kubernetes.io\u002Fname=tetragon\nkubectl logs -n kube-system -l app.kubernetes.io\u002Fname=tetragon -c export-stdout -f | head -20\n```\n\n### 2. Install Tetragon on Standalone Linux\n\nFor non-Kubernetes Linux hosts, install from the tarball release:\n\n```bash\ncurl -LO https:\u002F\u002Fgithub.com\u002Fcilium\u002Ftetragon\u002Freleases\u002Flatest\u002Fdownload\u002Ftetragon-linux-amd64.tar.gz\ntar xzf tetragon-linux-amd64.tar.gz\nsudo cp tetragon \u002Fusr\u002Flocal\u002Fbin\u002F\nsudo cp tetra \u002Fusr\u002Flocal\u002Fbin\u002F\n\n# Start tetragon daemon\nsudo tetragon --btf \u002Fsys\u002Fkernel\u002Fbtf\u002Fvmlinux &\n\n# Stream events\ntetra getevents -o compact\n```\n\n### 3. Monitor Process Execution (Default)\n\nTetragon generates `process_exec` and `process_exit` events by default without any TracingPolicy:\n\n```bash\n# Stream process events in compact format\ntetra getevents -o compact\n\n# Stream in JSON for SIEM ingestion\ntetra getevents -o json | jq '.process_exec \u002F\u002F .process_exit'\n```\n\nExample `process_exec` JSON event:\n\n```json\n{\n  \"process_exec\": {\n    \"process\": {\n      \"binary\": \"\u002Fusr\u002Fbin\u002Fcurl\",\n      \"arguments\": \"https:\u002F\u002Fmalicious.example.com\u002Fpayload\",\n      \"cwd\": \"\u002Ftmp\",\n      \"uid\": 1000,\n      \"pod\": {\n        \"namespace\": \"default\",\n        \"name\": \"webapp-7b4d9f8c6-x2k9p\"\n      },\n      \"parent\": {\n        \"binary\": \"\u002Fbin\u002Fbash\",\n        \"pid\": 1234\n      }\n    }\n  }\n}\n```\n\n### 4. Author TracingPolicy for File Access Monitoring\n\nCreate a TracingPolicy CRD to monitor access to sensitive files via the `sys_openat` kprobe:\n\n```yaml\n# file-access-monitor.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: monitor-sensitive-file-access\nspec:\n  kprobes:\n    - call: \"fd_install\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"int\"\n        - index: 1\n          type: \"file\"\n      selectors:\n        - matchArgs:\n            - index: 1\n              operator: \"Prefix\"\n              values:\n                - \"\u002Fetc\u002Fshadow\"\n                - \"\u002Fetc\u002Fpasswd\"\n                - \"\u002Fetc\u002Fsudoers\"\n                - \"\u002Froot\u002F.ssh\u002F\"\n                - \"\u002Fetc\u002Fkubernetes\u002Fpki\u002F\"\n          matchActions:\n            - action: Post\n```\n\nApply and observe:\n\n```bash\nkubectl apply -f file-access-monitor.yaml\ntetra getevents -o compact --process-filter \"event_set:PROCESS_KPROBE\"\n```\n\n### 5. Author TracingPolicy for Network Connection Monitoring\n\nMonitor outbound TCP connections using the `tcp_connect` kprobe:\n\n```yaml\n# network-monitor.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: monitor-tcp-connections\nspec:\n  kprobes:\n    - call: \"tcp_connect\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"sock\"\n      selectors:\n        - matchActions:\n            - action: Post\n```\n\n### 6. Author TracingPolicy for Privilege Escalation Detection\n\nDetect setuid\u002Fsetgid calls that may indicate privilege escalation:\n\n```yaml\n# privilege-escalation-detect.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: detect-privilege-escalation\nspec:\n  kprobes:\n    - call: \"__sys_setuid\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"int\"\n      selectors:\n        - matchArgs:\n            - index: 0\n              operator: \"Equal\"\n              values:\n                - \"0\"\n          matchActions:\n            - action: Post\n    - call: \"commit_creds\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"cred\"\n      selectors:\n        - matchActions:\n            - action: Post\n```\n\n### 7. Runtime Enforcement with Sigkill Action\n\nBlock unauthorized binary execution by killing the process in-kernel:\n\n```yaml\n# enforce-binary-allowlist.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: enforce-no-crypto-miners\nspec:\n  kprobes:\n    - call: \"sys_execve\"\n      syscall: true\n      args:\n        - index: 0\n          type: \"string\"\n      selectors:\n        - matchArgs:\n            - index: 0\n              operator: \"Postfix\"\n              values:\n                - \"xmrig\"\n                - \"minerd\"\n                - \"cpuminer\"\n                - \"cryptonight\"\n          matchActions:\n            - action: Sigkill\n```\n\n### 8. Export Events to SIEM\n\nConfigure Tetragon to export JSON events to a file sink for Fluentd\u002FFilebeat\u002FVector ingestion:\n\n```bash\n# Helm values for file export\nhelm upgrade tetragon cilium\u002Ftetragon -n kube-system \\\n  --set tetragon.exportFilename=\u002Fvar\u002Flog\u002Ftetragon\u002Ftetragon.log \\\n  --set tetragon.exportFileMaxSizeMB=100 \\\n  --set tetragon.exportFileMaxBackups=5\n```\n\nThen configure your log shipper (e.g., Filebeat) to tail `\u002Fvar\u002Flog\u002Ftetragon\u002Ftetragon.log` and send to your SIEM.\n\n### 9. Kubernetes-Aware Namespace Filtering\n\nUse `TracingPolicyNamespaced` to scope monitoring to specific namespaces:\n\n```yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicyNamespaced\nmetadata:\n  name: monitor-production-file-access\n  namespace: production\nspec:\n  kprobes:\n    - call: \"fd_install\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"int\"\n        - index: 1\n          type: \"file\"\n      selectors:\n        - matchArgs:\n            - index: 1\n              operator: \"Prefix\"\n              values:\n                - \"\u002Fetc\u002Fshadow\"\n                - \"\u002Fetc\u002Fpasswd\"\n```\n\n## Examples\n\n### Detect Reverse Shell Connections\n\n```yaml\n# reverse-shell-detect.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: detect-reverse-shells\nspec:\n  kprobes:\n    - call: \"tcp_connect\"\n      syscall: false\n      args:\n        - index: 0\n          type: \"sock\"\n      selectors:\n        - matchBinaries:\n            - operator: \"In\"\n              values:\n                - \"\u002Fbin\u002Fbash\"\n                - \"\u002Fbin\u002Fsh\"\n                - \"\u002Fusr\u002Fbin\u002Fpython3\"\n                - \"\u002Fusr\u002Fbin\u002Fperl\"\n                - \"\u002Fusr\u002Fbin\u002Fnc\"\n                - \"\u002Fusr\u002Fbin\u002Fncat\"\n          matchActions:\n            - action: Post\n```\n\n### Monitor Container Escape Attempts\n\n```yaml\n# container-escape-detect.yaml\napiVersion: cilium.io\u002Fv1alpha1\nkind: TracingPolicy\nmetadata:\n  name: detect-container-escape\nspec:\n  kprobes:\n    - call: \"sys_openat\"\n      syscall: true\n      args:\n        - index: 0\n          type: \"int\"\n        - index: 1\n          type: \"string\"\n      selectors:\n        - matchArgs:\n            - index: 1\n              operator: \"Prefix\"\n              values:\n                - \"\u002Fproc\u002F1\u002Froot\"\n                - \"\u002Fproc\u002F1\u002Fns\"\n                - \"\u002Fsys\u002Fkernel\u002Fsecurity\"\n                - \"\u002Fproc\u002Fsysrq-trigger\"\n          matchActions:\n            - action: Post\n    - call: \"sys_mount\"\n      syscall: true\n      args:\n        - index: 0\n          type: \"string\"\n        - index: 1\n          type: \"string\"\n        - index: 2\n          type: \"string\"\n      selectors:\n        - matchActions:\n            - action: Post\n```\n\n### Full Event Pipeline: Tetragon to Elasticsearch\n\n```bash\n# Use tetra CLI to pipe events through jq into Elasticsearch\ntetra getevents -o json | jq -c 'select(.process_kprobe != null)' | \\\n  while IFS= read -r line; do\n    curl -s -X POST \"http:\u002F\u002Felasticsearch:9200\u002Ftetragon-events\u002F_doc\" \\\n      -H \"Content-Type: application\u002Fjson\" \\\n      -d \"$line\"\n  done\n```\n",{"name":5,"tags":24,"author":32,"domain":33,"license":15,"version":34,"nist_csf":35,"subdomain":40,"description":41,"nist_ai_rmf":42,"mitre_attack":46,"atlas_techniques":52},[25,26,27,28,29,30,31],"ebpf","tetragon","cilium","runtime-security","observability","kernel-security","kubernetes-security","mukul975","cybersecurity","1.0",[36,37,38,39],"DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02","security-operations","Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement. Covers TracingPolicy CRD authoring with kprobe\u002Ftracepoint hooks, in-kernel filtering via matchArgs\u002FmatchBinaries selectors, JSON event export, and integration with SIEM pipelines. Use when building kernel-level runtime security observability for Linux hosts or Kubernetes clusters.\n",[43,44,45],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[47,48,49,50,51],"T1078","T1190","T1059","T1685.002","T1685.005",[53,54,55],"AML.T0070","AML.T0066","AML.T0082","main","d69096e239f2a89aabc2cd078c47664a9d3b1e11","04-安全渗透\u002Fimplementing-ebpf-security-monitoring",3,"https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts","https:\u002F\u002Fgithub.com\u002Flza6","个人vx：Tf00798\r\n个人✈：@TFGY999","2026-10-08 14:29:22",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add lza6\u002FArmor-piercing-system-prompts --skill implementing-ebpf-security-monitoring",{"tool":70,"command":71},"bunx","bunx skills add lza6\u002FArmor-piercing-system-prompts --skill implementing-ebpf-security-monitoring",{"tool":73,"command":74},"pnpm","pnpm dlx skills add lza6\u002FArmor-piercing-system-prompts --skill implementing-ebpf-security-monitoring","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F04-安全渗透\u002Fimplementing-ebpf-security-monitoring\u002FSKILL.md",true,[78],{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fapi-reference.md","REFERENCE","参考文档",5489,"https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F04-安全渗透\u002Fimplementing-ebpf-security-monitoring\u002Freferences\u002Fapi-reference.md",[85,93,100,107,114,121],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M7EXRM12046G0GM1WGMMFXCN","ci-cd-and-automation","Automates CI\u002FCD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.","MIT","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fci-cd-and-automation\u002FSKILL.md",[],[],{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":19},"01M7EXRFYYSJ3Y15AGPDDEWWQD","chrome-devtools","Uses Chrome DevTools via MCP for efficient debugging, troubleshooting and browser automation. Use when debugging web pages, automating browser interactions, analyzing performance, or inspecting network requests. This skill does not apply to `--slim` mode (MCP configuration).","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchrome-devtools\u002FSKILL.md",[],[],{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":19},"01M7EXR6EYPE4X5X1BTAE6QJRV","chrome-cdp","Drive a real Chrome via the Chrome DevTools Protocol (CDP). Ensures a\ndebuggable Chrome is running (launching it if needed) so the agent can\nnavigate, read page content, inspect the DOM, run JavaScript, and take\nscreenshots — without the user typing any launch command. Includes a\nfirst-class \"review a live running app\" flow: point Chrome at the app under\ndevelopment and inspect\u002Fscreenshot the REAL page (what a static-artifact tool\ncannot do). Backed by Glimpse and the chrome-devtools MCP server. Use when\nasked to \"use chrome\", \"open chrome\", \"drive my browser\", \"read the page in\nchrome\", \"review the running app\", \"screenshot the app\", or \"\u002Fchrome-cdp\".","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchrome-cdp\u002FSKILL.md",[],[],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":19},"01M7EXR1Y7E79KQKG4J798XGH6","check-identity-pack","Run an AFP 100-point or AUSTRAC safe-harbour identity check over a set of documents, and report exactly what's missing. Use when the user asks to check identity documents, verify someone's ID for onboarding, or assess whether a document pack satisfies Australian identity requirements.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fcheck-identity-pack\u002FSKILL.md",[],[],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":19},"01M7EXQXW7C7PGREJW9ZZTZ16H","changelog","Auto-generates a changelog from git commits, sprint data, and design documents. Produces both internal and player-facing versions.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchangelog\u002FSKILL.md",[],[],{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":89,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":19},"01M7EXQMH2ZME3ANN8Q8MEWPFB","cellxgene-census","Query the CZ CELLxGENE Census programmatically for versioned public single-cell and spatial transcriptomics data. Use when you need population-scale cell metadata, gene expression slices, Census summary counts, source H5AD URIs\u002Fdownloads, embeddings, spatial Census data, or reference atlas comparisons across organisms, tissues, diseases, assays, and cell types. For analyzing your own local single-cell data use scanpy, anndata, or scvi-tools.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fcellxgene-census\u002FSKILL.md",[],[]]