eBPF
eBPF is a Linux kernel technology that safely executes verified, sandboxed programs in response to kernel, networking, system, or application events.
Cyber Threat Hunting
eBPF is a Linux kernel technology that safely runs sandboxed programs in response to kernel and networking events for observability, tracing, and security enforcement.
- How it is used
- Provides container command, network, and system visibility during Kubernetes threat hunting.
- How deep it goes
- Explains deployment and Falco rule use, but defers eBPF program internals to operational detection practice.
- Examples
- Uses Falco alerts for in-container kubectl execution, API-server contact, and a file-upload rule exercise.
- What you can do after
- Apply it via Falco to collect container activity and create detection rules for suspicious behavior.
Cloud Observability in Action
eBPF is a technology for safely running sandboxed programs in the Linux kernel to observe or extend system behavior.
- How it is used
- Supports instrumentation-free observability, continuous profiling, and kernel-level telemetry collection for debugging and performance analysis.
- How deep it goes
- Explains verified kernel execution, user-space access, event triggering, and observability uses, but does not detail program construction.
- Examples
- Uses Pixie debugging, operating-system profiles, flame graphs, and Go auto-instrumentation as concrete applications.
- What you can do after
- Apply it via observability tools to collect profiles and telemetry without application changes, subject to platform compatibility.
Related concepts
- Falcoused by · Falco is an open-source cloud-native runtime security tool that monitors system activity to detect suspicious or anomalous behavior in hosts, containers, and Kubernetes environments.
- Dataplane v2used by · Dataplane V2 is a GKE networking dataplane architecture based on eBPF and Cilium for implementing pod networking and network policy.
- Linuxuses · Linux is an open-source operating-system kernel and the family of Unix-like operating systems built around it.
- Pixieused by · Pixie is a Kubernetes-specific, real-time debugging platform that collects and analyzes telemetry without requiring manual instrumentation or application redeploys.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.