mirror of
https://github.com/empayre/fleet.git
synced 2024-11-06 17:05:18 +00:00
1.7 KiB
1.7 KiB
eBPF & the future of osquery on Linux
What is the state of event instrumentation with osquery on Linux today? How is the Audit framework meeting Linux visibility needs, and what are the shortcomings of the approach? What is eBPF and how will it open new opportunities for osquery instrumentation on Linux?
This talk discusses the Audit approach to Linux events with osquery, including configuration and the capabilities exposed. eBPF is introduced along with the new bpf_process_events and bpf_socket_events tables. We conclude with thoughts about the future of eBPF and osquery on Linux.