Definition. An eBPF-based component from the Cilium project for runtime observability and policy enforcement in the Linux kernel. Tetragon records process, file and network activity close to the kernel, can block actions synchronously and works with the Cilium CNI on a shared eBPF data plane.

Why it matters. While Falco traditionally focuses on “detect and alert”, Tetragon can also handle enforcement. This matters for setups in which runtime violations should be stopped as well as logged.

Related. Falco, Runtime Security, Threat Detection, Container Escape