What is eBPF?

eBPF (extended Berkeley Packet Filter) is a revolutionary technology that allows programs to run safely inside the Linux kernel without changing kernel source code or loading kernel modules. AlertKick uses eBPF to provide deep, real-time security monitoring of your servers.

How eBPF Works

Traditional security tools run in user space and can only see what the operating system chooses to expose. eBPF runs directly in the kernel, giving it complete visibility into system activity as it happens.

How eBPF monitors kernel events and streams them to AlertKick

The Key Components

1. eBPF Programs: Small, verified programs that attach to kernel events (called “probes”)
2. Kernel Probes: Hooks at critical points like file access, process creation, network connections
3. Event Streaming: Security events are captured and sent to the AlertKick agent in real-time
4. AI Analysis: Events are analyzed, classified using MITRE ATT&CK, and alerts are triggered

Why eBPF for Security?

Complete Visibility

eBPF sees everything that happens on your system:

• File operations: Every file opened, read, written, or deleted
• Process activity: Every command executed, including arguments
• Network connections: All outbound and inbound connections
• Privilege changes: sudo usage, capability changes, setuid calls
• Container escapes: Attempts to break out of container boundaries

Zero Blind Spots

Traditional security tools have gaps:

Traditional Tools	eBPF
Can be bypassed by rootkits	Runs in kernel, sees raw events
Miss fileless attacks	Sees all process execution
Log-based (can be deleted)	Real-time event capture
Agent overhead	Minimal CPU/memory impact

Safe by Design

eBPF programs are:

• Verified before loading (can’t crash the kernel)
• Sandboxed (limited access to kernel functions)
• Read-only (observe only, no system modifications)

How AlertKick Uses eBPF

Real-Time Threat Detection

When suspicious activity occurs, AlertKick’s eBPF agent:

1. Captures the event at the kernel level (no way to hide)
2. Enriches with context (process tree, user, container)
3. Streams to AlertKick cloud securely
4. Classifies using MITRE ATT&CK framework
5. Analyzes with AI to determine severity and context
6. Alerts the right people through your escalation policies

Example: Detecting a Privilege Escalation

Event: setuid() called
Process: /tmp/.hidden/exploit
Parent: /bin/bash (PID 1234)
User: www-data
Container: web-frontend-abc123

MITRE ATT&CK: T1548 - Abuse Elevation Control Mechanism

AI Analysis: Unusual privilege escalation attempt from web
server process. Binary location (/tmp) is suspicious.
Recommend immediate investigation.

Severity: CRITICAL

What We Monitor

Category	Events Monitored
File System	Access to sensitive files (/etc/passwd, SSH keys, configs)
Processes	Shell spawns, script execution, binary execution
Network	Outbound connections, DNS queries, port binding
Privileges	sudo, su, setuid, capability changes
Containers	Namespace changes, escape attempts, mount operations

Getting Started

Ready to deploy eBPF security monitoring?

1. Install the agent: See eBPF Security Monitoring for setup instructions
2. Create security profiles: Define what to monitor for your environment
3. Configure alerts: Set up escalation policies for security events

Learn More About eBPF

Want to dive deeper into eBPF technology?

• What is eBPF? - Official eBPF Documentation
• eBPF Applications Landscape
• eBPF for Infrastructure

Next Steps

• eBPF Security Monitoring Setup - Install and configure eBPF agents
• MITRE ATT&CK Overview - Understand threat classification
• Escalation Policies - Configure alert routing