Tetragon
Cilium-suite eBPF runtime-security + observability. Isovalent (acquired by Cisco 2024), 2022. Kernel-level event detection + enforcement. Distinct from Falco: Tetragon can block events, not just alert.
Use cases: detect + prevent process execution, file access, network connections. TracingPolicy CRD defines what to monitor + what action (allow/deny/audit). Performance: low overhead, kernel-level filtering. Integrates with Cilium networking for a full eBPF-based platform. Cisco acquisition 2024: brought Tetragon under "Cisco Hypershield" product. Adoption: growing in Cilium-using shops. Distinct from traditional EDR: Tetragon kernel-native + Kubernetes-aware, no agent bloat.