1.cilium / tetragon
eBPF-based Security Observability and Runtime Enforcement
+29 stars
from 5,125 · score 3.40
Trending repositories
Ranked by Attention Score: stars gained over the last 7 complete days
10 repositories by Attention Score · Oct 29, 2026 – Nov 4, 2026 (UTC)
+15 stars
from 2,218 · score 2.77
3.gojue / ecapture
Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64\arm64 and loong64.
+12 stars
from 15,519 · score 2.56
4.iovisor / bcc
BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
+9 stars
from 22,718 · score 2.30
5.microsoft / ebpf-for-windows
eBPF implementation that runs on top of Windows
+9 stars
from 3,579 · score 2.30
6.eunomia-bpf / agentsight
lightweight system-level observability for AI Agents
+9 stars
from 762 · score 2.30
7.mozillazg / ptcpdump
Process-aware, eBPF-based tcpdump
- ebpf
- ebpf-tc
- tcpdump
- tcpdump-like
- ebpf-go
- network-capture
- +9 more
+4 stars
from 1,295 · score 1.61
8.libbpf / libbpf
Automated upstream mirror for libbpf stand-alone build.
+3 stars
from 2,776 · score 1.39
9.h3xduck / TripleCross
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
+2 stars
from 1,990 · score 1.10
10.Cybereason-Public / owLSM
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
- ebpf
- security
- linux-kernel
- linux-security-module
- sigma-rule
+1 stars
from 281 · score 0.69