kunai-project/kunai

Health v2 · maintenance only

Adoption not part of the score

1084 stars · 79 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Kunai is an eBPF-based threat-hunting and security-monitoring tool for Linux, often described as the Linux counterpart to Sysmon on Windows. It captures kernel-level events with eBPF probes and delivers chronologically ordered, enriched, and correlated events in a self-contained Rust binary that is also container-aware.

Use cases

• monitor Linux system events for security threats
• hunt for malicious activity on Linux hosts
• get a Sysmon-like event stream on Linux
• trace container activity with eBPF
• correlate and enrich kernel events for incident response
• detect suspicious process and file activity in real time

When to choose

• you need kernel-level event monitoring on Linux with a single standalone binary
• you want container-aware security telemetry
• you need chronologically ordered, correlated events for threat hunting
• you prefer a Rust/eBPF (Aya-based) tool over kernel modules

When to avoid

• you need security monitoring on Windows or macOS
• your kernel is too old or incompatible with eBPF probes
• you need a full SIEM or alerting pipeline rather than an event source
• you cannot run the tool with elevated (root) privileges

Facets

cli-tool · maturity active

monitoring security developer-tools security monitoring operating-systems cli rust ebpf threat-hunting security-monitoring sysmon-for-linux container-aware rust aya event-monitoring edr containers linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="kunai-project/kunai")