eBPF Runtime Security: From Detection to Enforcement with Falco and Tetragon

eBPF Runtime Security: From Detection to Enforcement with Falco and Tetragon

User-space security agents run at the same privilege level as the workloads they watch. A container with root access can kill -9 its monitoring sidecar, truncate logs, or run fileless payloads through memfd_create without ever writing to disk. The Sysdig Threat Research Team noted this in their November 2025 reverse shell analysis: attackers kill observability first, then escalate.

eBPF moves the observation point into the kernel. Probes attach directly to syscall entry points, so container-level attackers cannot disable them without escaping to the host kernel first. The engineering problem is not whether eBPF is better in theory—it is how to move from passive detection to active enforcement without breaking production workloads.

Why user-space agents fail

Most Kubernetes security tools run as DaemonSets or sidecars—ordinary user-space processes sitting next to the workloads they watch. This creates a symmetric weakness: the agent and its target share the same permission boundary. The InfoQ analysis from June 2026 found that replacing a full user-space agent stack with one eBPF-based agent cut security-related CPU use by 60–80% and reduced telemetry volume, because filtering happens in the kernel instead of the SIEM.

Performance gains matter, but the structural difference matters more. A container-root attacker cannot disable an eBPF probe without first escaping to the host kernel—a much harder task than terminating a user-space process.

Falco: syscall-level rules

Falco, donated by Sysdig to the CNCF in 2020, is a syscall-based rule engine. It reads kernel events through either a kernel module or an eBPF probe, then evaluates them against YAML-defined rules. The default rules cover container escapes, privilege escalations, sensitive file access, and MITRE ATT&CK container tactics.

A typical Falco rule for detecting shell execution in a container looks like this:

- rule: Terminal shell in container
  desc: A shell was spawned in a container
  condition: >
    container and
    proc.name in (bash, sh, zsh)
  output: >
    Shell spawned in container
    (user=%user.name container=%container.name)
  priority: WARNING

The rule engine evaluates conditions using fields like proc.name, user.uid, fd.name, and evt.type. Falco enriches raw syscalls with Kubernetes metadata—Pod name, namespace, Deployment controller, and ServiceAccount—reducing the manual correlation work that SIEM analysts otherwise perform across multiple log sources.

Tuning Falco rules in production

Default Falco rules are noisy. The Sysdig reverse shell analysis from 2025 showed why: early rules that matched dup syscall patterns and file descriptor types fired constantly because they lacked process-level context. Sysdig fixed this by adding proc.stdin, proc.stdout, and proc.stderr fields, so rules match behavior instead of single syscalls.

Deploying Falco effectively takes iteration:

The Falco rule style guide emphasizes performance: placing evt.type restrictions at the beginning of conditions, avoiding negative matches like evt.type != open (which monitors every supported syscall), and using macros to factor out common patterns. Rules that mix unrelated event types incur measurable CPU penalties at scale.

Tetragon: from observation to enforcement

Tetragon, built by Isovalent (now Cisco) and listed in Thoughtworks' Technology Radar, extends eBPF past detection into runtime enforcement. Falco alerts on suspicious behavior; Tetragon can kill the offending process before the syscall returns.

The key architectural difference is where the policy engine lives. Tetragon embeds it inside the eBPF program, so not every event crosses to user space. This cuts data volume and enables synchronous response. Liz Rice, Isovalent's open-source lead, told The New Stack in 2024 that Tetragon's hooks sit deeper in the kernel than standard syscall tracers, making them harder to race against in TOCTOU attacks.

How enforcement works

Tetragon enforces policy through two mechanisms:

Signal-based termination. The eBPF program calls send_signal() (Linux 5.3+) to send SIGKILL to a violating process. Cisco's NX-OS Live Protect feature uses this to ship CVE compensating controls without reboots. When PSIRT flags a vulnerability, the Tetragon team writes an eBPF shield; customers install the policy, test in monitoring mode, then flip to enforce.

LSM-based access control. Linux 5.7 added eBPF LSM hooks, which allow blocking a single function call instead of killing the whole process. An LSM hook can reject socket_sendmsg while letting the process continue everything else. Tetragon sticks with send_signal() for wider kernel compatibility, but the finer-grained option exists on 5.7+.

Policy scope

Tetragon policies define what is allowed, not what attacks look like. A policy might list:

• Allowed binaries inside a Pod
• Permitted file paths
• Allowed network destinations
• Whether privilege escalation or namespace changes are permitted

When a process crosses a boundary, Tetragon either alerts or acts. Cisco's NX-OS docs advise running new policies in monitoring mode first, checking hit counts with show nxsecure policy status, and switching to enforce only after confirming no false positives.

Architecture comparison

Both tools can operate independently of Cilium. Tetragon deploys via standard Helm charts without requiring Cilium as the CNI, though certain cross-node metadata features benefit from Cilium's presence.

How to deploy

Treat eBPF runtime security as a staged rollout, not a single migration.

Stage 1: Observability. Run Falco or Tetragon in monitoring mode on a subset of production nodes. Collect baseline data across at least two release cycles to capture CI/CD patterns, scheduled jobs, and normal admin activity.

Stage 2: Rule refinement. Add whitelist exceptions for legitimate behavior. Cloudflare's XDP-based eBPF filtering handled a 7.3 Tbps DDoS attack at under 5% CPU overhead, but that works only because the rules were tightly scoped. Broad rules generate noise and dull operator attention.

Stage 3: Alert-driven response. Send high-confidence detections to automated playbooks before trying in-kernel enforcement. The InfoQ analysis warns against skipping straight to enforcement: a bad rule that kills a payment service at 03:00 does more damage than the threat it was meant to stop.

Stage 4: Selective enforcement. Turn on Tetragon's SIGKILL only for narrowly scoped policies with a proven low false-positive rate. Keep broader behavioral rules in monitoring mode. Cisco's NX-OS does this explicitly, with separate monitor and enforce modes per policy package.

What this means for detection engineering

Moving to eBPF runtime security changes the workflow in three ways:

Context enrichment is automatic. Falco and Tetragon map kernel events to Kubernetes identities without manual log correlation. A connect() syscall from a container already includes Pod name, namespace, labels, and binary path.

Behavioral baselines replace signatures. Instead of chasing CVEs and exploit signatures, teams define what normal looks like for each workload. The Sysdig reverse shell analysis found that stateful observation—tracking multi-step syscall sequences across parent-child relationships—catches complex techniques that static rules miss.

Performance limits live in the kernel. The eBPF verifier caps program complexity, stack size, and memory access. Engineers writing custom probes need to know these limits; the Tetragon docs warn that adding a char cmdline[256] field to a process event can get rejected by the verifier.

Limitations

eBPF runtime security does not work everywhere. Windows containers have no eBPF support. Embedded Linux with heavily customized kernels may lack the BTF information that CO-RE probes need. Writing custom eBPF programs requires C or Rust knowledge, though Falco and Tetragon handle standard deployments without that.

Kernel version matters: send_signal() needs Linux 5.3, LSM hooks need 5.7, and BTF-enabled CO-RE probes need 5.8+. Organizations on older LTS kernels must either backport patches or live with reduced capability.

References

1. Sysdig Threat Research Team, "Hunting Reverse Shells", November 14, 2025.
2. Niranjan Sharma, "Kernel-Level Truth: Why eBPF Is Replacing User-Space Agents", June 25, 2026.
3. Dan Wendlandt, "Securing Kubernetes in the AI Era", October 21, 2025.
4. Cisco, "Secure NX-OS with Live Protect", April 27, 2026.
5. Thoughtworks Technology Radar, "Tetragon", April 2024.
6. Liz Rice interview on Tetragon architecture, September 2024.
7. "eBPF Runtime Security", January 15, 2024.
8. Falco Project, "Style Guide of Falco Rules", 2026.
9. Falco Project, "Glossary", 2023.
10. Elastic, "CNCF Falco Integration Guide", June 2026.
11. eBPF.io, "Tetragon: Security Observability and Runtime Enforcement".
12. Cloudflare. DDoS mitigation using XDP eBPF (7.3 Tbps attack, April 2025). Referenced in CSDN eBPF analysis, June 2026.