cilium/tetragon
eBPF-based Security Observability and Runtime Enforcement observed · 2026-08-28
Health v2 · maintenance only
95/100
- Activity 99
- Release rhythm 87
- Longevity 100
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.
- gap_med: 86
- age_days: 1624
- days_rel: 8
- days_push: 7
- n_releases_24m: 10
Adoption not part of the score
4955 stars · 594 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded
Tetragon is an eBPF-based security observability and runtime enforcement tool from the Cilium project. It monitors process execution, syscalls, file access, and network activity in real time at the kernel level, with Kubernetes-aware policies for workload-specific detection and enforcement.
Use cases
- monitor process execution and syscalls in kubernetes clusters
- detect and block binaries executed from /tmp
- file integrity monitoring for sensitive files
- track which processes make network connections
- monitor linux capability and privilege changes
- audit kernel module loading and eBPF subsystem activity
- enforce security policies at kernel level with low overhead
When to choose
- you need real-time, low-overhead security observability on Linux or Kubernetes
- you want runtime enforcement (blocking) of malicious activity at the kernel level
- you need security events correlated with Kubernetes identities like pods and namespaces
When to avoid
- your hosts don't run Linux or lack eBPF support (older kernels)
- you only need simple log aggregation or metrics without kernel-level tracing
- you need a host-based agent for non-Linux platforms like Windows or macOS
Facets
application · maturity active
monitoring security alerting logging tracing security monitoring cloud-computing self-hosted self-hosted cloud ebpf runtime-enforcement kubernetes-security observability cncf file-integrity-monitoring syscall-tracing runtime-security containers devops linux kubernetes docker
10 sources
- readme: https://github.com/cilium/tetragon · fetched 2026-08-28 · 1f8bc97149cd
- homepage: https://tetragon.io · fetched 2026-08-29 · 4b712e7c048e
- site_page: https://tetragon.io/docs · fetched 2026-08-29 · 045b31c8b0f4
- site_page: https://tetragon.io/docs/getting-started · fetched 2026-08-29 · 2b3b465c7629
- site_page: https://tetragon.io/features/capabilities-monitoring · fetched 2026-08-29 · b9114883769d
- site_page: https://tetragon.io/features/execution-monitoring · fetched 2026-08-29 · d6ad8b2ef3ef
- site_page: https://tetragon.io/features/file-integrity-monitoring · fetched 2026-08-29 · ba60038e65c8
- site_page: https://tetragon.io/features/kubernetes-identity-aware-policies · fetched 2026-08-29 · cf8c115ce0bb
- site_page: https://tetragon.io/features/network-observability · fetched 2026-08-29 · 86b023f2c209
- site_page: https://tetragon.io/features/operating-system-integrity · fetched 2026-08-29 · 75746855fc39
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| cilium/tetragon | main | 95 |
For agents
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem