Open Source Summit Europe 2023

eBPF can be used to observe events across a system and report information about those events to user space tools Using eBPF, you directly attach to kernel code paths and collect only the security observability events you define in near real time with no disruption to the application. Later, these events are sent to user space and can then be shipped to permanent storage for analysis, threat hunting, incident investigation, or building out security policy. The BPF feature for security system than can detect or even prevent malicious activity In this presentation, lets get started with BPF for security observability.