The safeguards map / 4.1 Detection and intake
Tetragon
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
An eBPF-based tool, part of Cilium, that detects security-significant events such as process execution, system calls and file or network access, and can react to them at runtime.
Where it sits
4.1 Detection and intake (primary): Detects process execution, system call and file or network activity events on Linux hosts and Kubernetes workloads, which is the point at which an incident becomes known.
Cilium’s new [Tetragon](https://tetragon.io) component enables powerful real-time, eBPF-based Security Observability and Runtime Enforcement.
captured
Tetragon detects and is able to react to security-significant events
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who run it
- Runs
- at runtime
Handoffs
None recorded. A mapped entry with no handoff is here for its foundation home.
Collector's note
Tetragon has no CNCF page of its own; it takes the maturity of its parent Cilium, and the README states it is a Cilium component. Placed in 4.1 as the same kind of runtime detection as Falco; its documented enforcement of responses is not given a second placement here.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.