Tetragon

Leverages eBPF for low-overhead observability, enabling real-time detection of process execution and system calls without significant performance degradation, as emphasized in the project's philosophy.

Integrates natively with Kubernetes, allowing security policies to target specific pods and namespaces, which is highlighted in the Kubernetes-aware detection feature for workload-specific monitoring.

Supports kprobes, tracepoints, and uprobes for advanced use cases like network observability and credential monitoring, as detailed in the generic tracing section and use case documentation.

Enables runtime reaction to security events, moving beyond passive monitoring to active prevention based on configured policies, which is a core value proposition.