Security Observability through eBPF in Google Cloud - Seguridad Mania.com - España y América Latina

Extended Berkeley Packet Filter or eBPF for short provides low level observability of the Linux kernel. With this low level observability, one can tap into individual kernel system call performance, as well as an as well as a wealth of other metrics. In this session, we’ll talk about how Sysdig leverages the power of eBPF for its open source projects, Sysdig and Falco. We will talk about how to discover performance metrics, (miss)behavior, errors, at all levels: network, file system, process etc. We will go through the challenges of practical observability, from tracing, custom metrics with Prometheus to agent/check based metric collection down to the kernel for eBPF system analysis.