Tetragon.

An eBPF-based Kubernetes runtime security tool from the Cilium project that observes and synchronously enforces policy on processes, files, and network activity. It belongs to the Cloud Security category of cybersecurity.

An eBPF-based Kubernetes runtime security tool from the Cilium project that observes and synchronously enforces policy on processes, files, and network activity.

Tetragon is an open-source runtime security platform that uses eBPF to observe and enforce policies at the kernel level on Kubernetes nodes. Unlike audit-only tools, Tetragon can synchronously block syscalls, kill processes, or override return values — for example, killing a workload that attempts to read /etc/shadow or open an unexpected outbound connection. Policies are expressed as TracingPolicy custom resources. Tetragon was open-sourced by Isovalent (now part of Cisco) and is part of the broader Cilium ecosystem within the CNCF. It complements admission-time controls and image scanning by providing high-fidelity, low-overhead runtime visibility and enforcement that traditional EDR struggles to deliver inside containers.

Defences for Tetragon typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Cilium Tetragon.