Tetragon
Cilium-suite eBPF-runtime-security + observability. Isovalent (acquired av Cisco 2024), 2022. Kernel-level event-detection + enforcement. Skiljs från Falco: Tetragon kan blocka events, ej bara alert.
Use cases: detect + prevent process-execution, file-access, network-connections. TracingPolicy CRD definierar what to monitor + what action (allow/deny/audit). Performance: low-overhead, kernel-level filtering. Integrates med Cilium-networking för full eBPF-based-platform. Cisco-acquisition 2024: brought Tetragon under "Cisco Hypershield"-product. Adoption: growing in Cilium-using-shops. Skiljs från traditional EDR: Tetragon kernel-native + Kubernetes-aware, no agent-bloat.