Getting Started with BPF Security Observability

Explore the power of eBPF for security observability in this informative conference talk. Learn how to leverage eBPF to observe system events, collect specific security data in near real-time, and report it to user space tools without disrupting applications. Discover the process of attaching directly to kernel code paths, defining custom security observability events, and shipping collected data for analysis, threat hunting, incident investigation, and security policy development. Gain insights into BPF's potential for detecting and preventing malicious activity, and acquire the foundational knowledge needed to implement BPF-based security systems in your own environment.

Getting Started with BPF Security Observability - Vandana Salve, Independent Consultant