1.cilium / tetragon
eBPF-based Security Observability and Runtime Enforcement
+277 stars
from 4,877 · score 5.63
Ranked by Attention Score: stars gained over the last 90 complete days
6 repositories by Attention Score · Aug 7, 2026 – Nov 4, 2026 (UTC)
eBPF-based Security Observability and Runtime Enforcement
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit