tetragon — The Cyber Toolchain

tetragon v1.8.0

Fri, 30 Oct 2026 17:18:17 GMT

Tetragon v1.8.0 adds stateful tracing policies, command-line argument selectors, mTLS for the gRPC server, and uprobe binary digest verification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Add new tracing policy selectors: `matchCmdArgs` to filter tracing events by individual command-line arguments of the invoking process, `matchWorkloads`, `nodeSelector`, and `MatchCEL` to allow mixing arguments and data in CEL expressions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Add caller function filtering to uprobe selectors in tracing policies. • Add support for stateful tracing policies, gRPC-based persistent policies, JSON schema and CEL validation for tracing policies without Kubernetes support, an eBPF-based glob library for tracing policy matching, and domain-sharded tracing policy management. • Replace the deprecated `sizeArgIndex` field with `sizeFromArgIndex` in tracing policies. • Add the uprobe `Set` action with `u64 argValue` support, and symbolized user-space stack traces to `ProcessUprobe` events for uprobe Post actions that enable `userStackTrace`. • (improved) Add `argNew{Symbol,Addr,Offset}` support to the uprobe override action and support for multiple `sopath` actions in uprobes. • (improved) Add support for CEL expressions in `argRegs` register overrides, bit-shifting operators (`lsh`, `rsh`), 16-bit and 8-bit signed and unsigned integers, and multiplication and division operators to CEL expressions. • Add bitwise operators (`and`, `or`, `xor`, `not`) for CEL expressions. • Add `btfType` and `btfTypeModule` argument types, support for the `fd` type to retrieve `file*`, the `--sleepable-preload-size` option to configure the sleepable preload size, a read-only, frozen configuration map, the `--execve-map-no-prealloc` option to control execve map memory allocation, and BPF area-specific `DEBUG()` rodata configuration for BPF sensors. • Add support for multiple preloaded string-resolved arguments in BPF sensors. Breaking changes: • The deprecated `sizeArgIndex` field is replaced by `sizeFromArgIndex`; policies using `sizeArgIndex` must be updated. • Deprecated actions have been removed; policies referencing them will be rejected on upgrade. • `matchArgs`/`matchBinaries` Postfix and NotPostfix values longer than 87 characters are now rejected on kernels without large BPF program support. • The gops debug interface is now disabled by default in the Helm chart. • Metrics labels are changed: `opcode` now carries the numeric `ops.OpCode`, `opstr` is the new label for its readable name, and `event_type` replaces prior EventType labeling; dashboards or alerts keyed on the old label names will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v1.7.1

Tue, 25 Aug 2026 11:40:47 GMT

Tetragon v1.7.1 adds `int` tracepoint args, `btfType`/`btfTypeModule` support, and broader policy-filter scoping for uprobes and USDT events. • Adds `btfType` and `btfTypeModule` support in tracing policies, enabling more precise BTF-based type resolution for kernel arguments. • Adds `int` argument type support for tracepoints in TracingPolicy, expanding the set of kernel tracepoint arguments that can be traced and filtered. • Allows `hostSelector` in TracingPolicy without requiring the `enable-policy-filter` daemon flag, reducing configuration overhead for host-scoped policies. • Scopes uprobe and USDT events through policy filters, bringing them in line with kprobe/tracepoint filtering capabilities. • Applies redaction filters to all environment variables in events, broadening the reach of existing redaction configuration. Breaking changes: • `returnArgAction` no longer accepts `Post` as a value in TracingPolicy. Use `returnArg` to include return values in events and omit `returnArgAction` for default behavior; only `TrackSock` and `UntrackSock` remain supported. Existing policies with `returnArgAction: "Post"` must remove that field. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v1.7.0

Wed, 29 Apr 2026 17:19:49 GMT

Tetragon v1.7.0 adds CEL-in-BPF evaluation, fentry sensor, env-var retrieval, host selectors, and broad uprobe enhancements. • Adds support for retrieving environment variables in kprobe/uprobe events. • New `matchParentBinaries` selector for filtering events based on ancestor process binaries. • Evaluates CEL expressions directly in BPF (`celbpf`), reducing userspace overhead for policy enforcement. • New fentry sensor for attaching to kernel function entry points via fentry BPF programs. • Adds `spec.hostSelector` support in TracingPolicies to target specific nodes. • Adds uretprobe support for uprobes, enabling `return`, `returnArg`, and `args.returnCopy` in uprobe policies. • Supports argument matching selectors (matchArgs, etc.) in uprobe policies. • Adds `resolve:` support for uprobes, enabling pointer dereference in userspace probe arguments. • Supports register-based data retrieval for kprobe and uprobe on supported architectures. • Adds `current_task` resolve support for uprobes. • Supports preloading user strings in uprobe/usdt probes. • Enables sleep-able USDT argument reading. • Adds uprobe register override support on arm64. • Adds `tetra explain` command for standalone CRD documentation. • Adds `node_name` label to Tetragon metrics. • New `tetragon_debug_events_total` metric for non-critical BPF event tracking. • New consolidated `tetragon_generic_kprobe_merge_total` metric with `status`, `curr_type`, `prev_type`, `curr_fn`, and `prev_fn` labels. • Adds regex support for namespace filtering in export allow/deny lists. • Adds substring operators for selector matching. • Adds monitor-only mode for uprobes and stats. • Adds a separate configuration option for enabling ancestors in ProcessLoader events. • Adds process cache and execve map dumps to `tetra bugtool` generated tarballs. • Supports (u)int8/16 types in selectors. • Adds `tetragon_process_cache_early_deletions_total` metric for process cache GC observability. • Uses tracefs instead of debugfs for BPF program attachment. • New retprobes events cache size configuration option. • Adds USDT argument reading support on arm64. • Adds gRPC info reporting for agent diagnostics. Breaking changes: • The default server-address of the agent changes from `localhost:54321` to `/var/run/tetragon/tetragon.sock`; update all third-party programs that connect to the agent. • The legacy stacktrace-tree API has been removed: the `GetStackTraceTree` gRPC method, `tetra stacktrace-tree` CLI command, and related types (`GetStackTraceTreeRequest`, `GetStackTraceTreeResponse`, `stack.proto`) no longer exist; use TracingPolicy with `kernelStackTrace` and `userStackTrace` in the Post action instead. • The already-deprecated `EnableTracingPolicy` and `DisableTracingPolicy` gRPC methods now return an error when used; set `enable-deprecated-tracingpolicy-grpc` to restore old behavior until the next release removes them entirely. • Metrics `tetragon_generic_kprobe_merge_errors_total` and `tetragon_generic_kprobe_merge_ok_total` have been removed and replaced by `tetragon_generic_kprobe_merge_total` with a `status` label; update any dashboards or alerts referencing the old metric names. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v1.6.1

Tue, 31 Mar 2026 17:48:14 GMT

Tetragon v1.6.1 adds uprobe match-args support, BTF resolution for uprobes, and switches to tracefs. • Supports `matchArgs` filtering in uprobe-based tracing policies. • Enables BTF-based type resolution for uprobe sensors. • Switches from debugfs to tracefs for BPF tracing attachment. • Allows tracing policies to load even when `kptr_restrict` is set to 2. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v1.6.0

Thu, 23 Oct 2025 10:53:08 GMT

Tetragon v1.6.0 adds USDT sensor, uprobe override action, ring buffer support, range filters, and per-policy action counters. • Adds USDT (User Statically Defined Tracing) sensor with action support, set action, sibling argument parsing, and resolve support in USDT tracing policies. • Adds uprobe override action for modifying program behavior at uprobe attachment points. • Adds `bpf_prog` argument type support for kprobes, enabling introspection of BPF programs. • Supports BPF ring buffer as the default event transport on kernels v5.11 and later for improved performance. • Adds range filter support for selectors in tracing policies. • Adds per-policy action counters to TracingPolicy, exposing how many times each action has fired. • Adds `pod.uid` field to the Kubernetes Pod API, surfacing pod UIDs in events. • Adds container name regex filtering for `tetra getevents`. • Adds `tetra probe config` command to check kernel configuration compatibility. • Adds `export.stdout.envFromSecrets` Helm value to inject environment variables from Kubernetes Secrets into the export stdout process. • Adds `nameOverride` Helm support for the `tetragon-rthooks` component. • Enables k8s control plane metadata enrichment for non-Kubernetes (standalone) deployments. • Tetragon Operator now defaults to running as non-root (UID 65532); a new `tetragonOperator.runAsRoot` Helm option allows overriding this. Breaking changes: • The `--enable-process-ancestors` boolean flag has been removed; configurations using this flag will fail on upgrade. • The Tetragon Operator now runs as non-root (UID 65532) by default; workloads relying on root-based operator behavior must set `tetragonOperator.runAsRoot: true` to preserve the previous behavior. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v1.5.0

Tue, 29 Jul 2025 09:35:13 GMT

Tetragon v1.5.0 adds Windows process monitoring, raw tracepoints, uprobe actions, pod annotations/node labels in events, and a CapabilitiesGained policy operator. • Adds Windows support for process create and exit events, enabling Tetragon to monitor process lifecycle on Windows hosts. • Adds raw tracepoint support in tracing policies for lower-overhead kernel event collection. • Enables actions (e.g., signal, override) on uprobes in tracing policies. • Allows uprobes to be defined with `offset` and `ref_ctr_offset` for precise attach-point control. • Adds pod annotations to Tetragon events, enriching process events with Kubernetes metadata. • Adds Kubernetes node labels to Tetragon events for richer event context. • Adds `.process.pod.container.privileged` field to PodInfo in events, surfacing container privilege status. • Adds `CapabilitiesGained` operator in tracing policy selectors to match on Linux capability escalations. • Adds `repo` key support in `containerSelector` within policy filters for image-repository-based policy scoping. • Supports IPv4-mapped IPv6 address form in tracing policy network selectors. • Adds `--enable-ancestors` flag to consolidate ancestor-tracking configuration across all event types. • Allows tracing policies to ignore kprobes for kernel symbols that cannot be found, improving policy resilience. • Adds path offload support for BPF programs. • Adds support for `followChildren` of older processes in `matchBinaries` selectors. • Excludes exit events from rate limiting to ensure process exit is always captured. • Adds `tetragon.nameOverride` and `tetragonOperator.nameOverride` Helm values for chart name customization. • Adds pprof CPU profile collection to the `bugtool` command. Breaking changes: • The log level string `level=warning` is now emitted as `level=warn` after the migration from logrus to log/slog; custom scripts or tools parsing Tetragon logs may need updating. • The default metrics scrape interval for `tetragon.prometheus.serviceMonitor.scrapeInterval` and `tetragonOperator.prometheus.serviceMonitor.scrapeInterval` is changed from 10s to 60s. • The `OciHookSetup` Helm section is removed (was deprecated in v1.2); any Helm values under that section will no longer be recognized. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v1.4.0

Fri, 21 Mar 2025 17:27:28 GMT

Tetragon v1.4 adds ancestor tracking in process events, CEL filters, monitoring mode for tracing policies, and Windows build support. • Adds ancestor process information to process events, giving full lineage context for every observed action. • Adds attribute resolution in tracing policies for richer event enrichment. • Adds a monitoring mode for tracing policies, allowing policies to observe without enforcing. • Adds CEL filter support to the `tetra` CLI for client-side event filtering. • Adds support for `struct socket` and `struct sockaddr` as argument types in tracing policies. • Adds `tetra policyfilter listpolicies` command to list active policy filters. • Adds `map_errors_update_total` and `map_errors_delete_total` metrics replacing the former `tetragon_map_errors_total`. • Adds Helm values `cri.enabled`, `cri.socketHostPath`, and `cgidmap.enabled` for CRI socket configuration and cgroup-ID mapping, with accompanying metrics for cgidmap CRI resolution. • Supports running multiple Tetragon operator replicas simultaneously via `tetragonOperator.replicas` and `tetragonOperator.failoverLease.enabled`. • Removes the deprecated gRPC sensors API. • Allows extending ClusterRoles and operator ConfigMap via Helm. • Begins Windows build support for Tetragon (Part -1). Breaking changes: • The `tetragon_map_errors_total` metric is replaced by `map_errors_update_total` and `map_errors_delete_total`; any dashboards or alerts referencing the old metric name will break. • The deprecated gRPC sensors API is now removed; any client code calling those endpoints will break. • The default toleration (`operator: Exists`) for the operator Deployment has been removed; operator pods that relied on this toleration to schedule on tainted nodes will no longer do so automatically. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v1.3.0

Fri, 13 Dec 2024 13:12:39 GMT

Tetragon v1.3.0 adds IMA hashes in LSM events, CEL filters, ABI-aware syscall64 events, and new process-tree tracking flags. • Adds IMA hash information to LSM events for file integrity visibility. • Adds support for associating pod information when nested cgroups are used. • Adds ABI information to `syscall64` type events — output now uses a `SyscallId` object with `id` and `abi` fields to distinguish 64-bit and 32-bit syscalls unambiguously. • Adds support for tracing 32-bit ARM (aarch32) syscalls. • Adds all operator support (including `Mask`) for the `syscall64` tracing policy type. • Adds BPF operations support in tracing policies (`tracingpolicy`). • Adds a Common Expression Language (CEL) filter for event export, including IP and CIDR helper functions. • Adds a regex filter type for parent process arguments. • Introduces the `in_init_tree` flag on process events indicating whether a process spawned from its container's init process tree. • Introduces a `container_id` export filter and an `in_init_tree` export filter. • Exposes BPF map kernel memory use per tracing policy via the gRPC API and the `tetragon_tracingpolicy_kernel_memory_bytes` metric. • Adds an optional `cluster_name` field to `GetEventsResponse` in the protobuf API. • Adds `tetragon_enforcer_missed_notifications_total` metric for the enforcer. • Adds metrics for LRU data cache. • Adds overhead metrics for BPF programs. • Adds version information to build information metrics. • Adds `tetra debug progs` command for inspecting loaded BPF programs. • Adds BPF program type information to the API. • Allows multiple symbol instances in kprobe specs. • Enables `matchBinary` names to use process arguments as match criteria. • Adds policy filter support for the cgroup tracker (`cgtracker`). • Adds shortnames and category labels for Tetragon CRDs. • Enables `tetra` bash autocompletion inside the Tetragon container image. • Adds an `enabled` switch in the Helm chart to control the gops server (now disabled by default). Breaking changes: • The `syscall64` type now outputs a `SyscallId` object (`{"syscall_id":{"id":309,"abi":"x64"}}`) instead of a bare `size_arg`; consumers parsing raw `size_arg` fields will break. Use `--enable-compatibility-syscall64-size-type` to preserve the old behavior temporarily (flag removed in v1.4). • The `tetragon_ratelimit_dropped_total` metric is renamed to `tetragon_export_ratelimit_events_dropped_total`; any dashboards or alerts referencing the old name will stop receiving data. • The `--expose-kernel-addresses` flag has been removed; agents using this flag will fail to start. • The `--pprof-addr` flag has been removed; agents using this flag will fail to start. • The `--enable-process-ancestors` flag has been removed; agents using this flag will fail to start. • The behavior of `--export-file-perm` (and Helm value `tetragon.exportFilePerm`) changed: on log rotation Tetragon will now enforce the specified permissions on existing export files, whereas previously existing file permissions were preserved. Verify the existing export file permissions match the configured value (default `600`) before upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v1.2.1

Wed, 27 Nov 2024 10:53:14 GMT

Tetragon v1.2.1 adds regex filtering on parent process arguments and tunable event cache retry parameters. • New `parent_arguments_regex` filter type lets policies match events by parent process argument patterns using regular expressions. • Event cache retry count and delay intervals are now tunable, giving operators control over cache behavior under load. • Adds a cache for deleted pods to improve pod association accuracy after pod termination. • Adds support to dump the processLRU cache for operational introspection. • Adds support to exclude valid processes from processCache dumps, reducing noise during diagnostics. Breaking changes: • The deprecated `tetragon.skipCRDCreation` Helm value has been removed; Helm charts referencing it will fail on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v1.2.0

Thu, 05 Sep 2024 13:26:01 GMT

Tetragon v1.2.0 adds LSM sensor, username enrichment, persistent enforcement, NRI runtime hooks, and new MatchBinaries operators. • Adds LSM (Linux Security Module) sensor for LSM-based policy enforcement and event generation. • Adds username enrichment to `process_exec` events, resolving UIDs to login names via `/proc` and a local cache. • Supports persistent enforcement during Tetragon restarts, maintaining policy enforcement across agent lifecycle. • Adds NRI (Node Resource Interface) support for runtime hooks via `tetragon.rthooks`. • Adds `FollowChildren` attribute to `MatchBinaries` selector in tracing policies, enabling matching on child processes. • Adds `Postfix` and `NotPostfix` operators to the `matchBinaries` selector. • Adds cgroup rate support for limiting events per cgroup. • Adds export filter targeting parent process binary name. • Adds dynamic log level change option via the `tetra` CLI. • Adds `tetragon_pod` label to metrics via ServiceMonitor and supports extra labels on ServiceMonitors. • Exposes kernel ring buffer errors and Go scheduler latencies in metrics. • Adds missed probes metrics. • Adds debug Helm flag for the agent. • Enforces single Tetragon instance per node. • Adds compact print support for LSM events in `tetra` CLI. Breaking changes: • The `tetragonOperator.skipCRDCreation` Helm value is removed; use `crds.installMethod=none` instead. • The default liveness probe is now gRPC instead of `tetra status`; to keep using `tetra status`, specify `tetragon.livenessProbe` in Helm values. • The `tetragon_policyfilter_metrics_total` metric is renamed to `tetragon_policyfilter_operations_total`, and its `op` label is renamed to `operation`. • The `tetragon_missed_events_total` metric is renamed to `tetragon_bpf_missed_events_total`. • `tetragon_ringbuf_perf_event_errors_total` is renamed to `tetragon_observer_ringbuf_errors_total`. • `tetragon_ringbuf_perf_event_received_total` is renamed to `tetragon_observer_ringbuf_events_received_total`. • `tetragon_ringbuf_perf_event_lost_total` is renamed to `tetragon_observer_ringbuf_events_lost_total`. • `tetragon_ringbuf_queue_received_total` is renamed to `tetragon_observer_ringbuf_queue_events_received_total`. • `tetragon_ringbuf_queue_lost_total` is renamed to `tetragon_observer_ringbuf_queue_events_lost_total`. • `tetragon_errors_total{type="process_cache_evicted"}` is replaced by `tetragon_process_cache_evicted_total`. • `tetragon_errors_total{type=~"process_cache_miss_on_get|process_cache_miss_on_remove"}` metrics are replaced by `tetragon_process_cache_misses_total{operation=~"get|remove"}`. • `tetragon_event_cache__errors_total` metrics are replaced by `tetragon_event_cache_fetch_failures_total{entry_type=""}`. • `tetragon_event_cache_accesses_total` is renamed to `tetragon_event_cache_inserts_total`. • `tetragon_event_cache_retries_total` is renamed to `tetragon_event_cache_fetch_retries_total`. • `tetragon_errors_total{type="event_missing_process_info"}` is replaced by `tetragon_events_missing_process_info_total`. • `tetragon_errors_total{type="handler_error"}` is removed; use `tetragon_handler_errors_total` instead. • The sensor managing gRPC API methods `ListSensors`, `EnableSensor`, `DisableSensor`, and `RemoveSensor` are deprecated. • `tetragon.ociHookSetup` Helm value is deprecated; use `tetragon.rthooks` instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v1.1.2

Wed, 12 Jun 2024 13:43:18 GMT

Tetragon v1.1.2 adds `tetragon.livenessProbe` Helm value and improves uid resolution via backports • Adds `tetragon.livenessProbe` to Helm values to customize the liveness probe configuration • Adds uid username resolution support (backported from v1.1) to improve identity context in traces Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v1.1.0

Mon, 29 Apr 2024 14:44:08 GMT

Tetragon v1.1.0 adds user-space stack traces, enforcer sensor for syscall denial, OCI hook support, multi-link uprobes, and redaction filters. • TracingPolicy `policy` action `NotifyEnforcer` replaces the deprecated `NotifyKiller` to deny system calls via the enforcer sensor • Helm value `crds.installMethod=none` is available; the previous `tetragonOperator.skipCRDCreation` is deprecated • The `policy.filter.containerSelector` field allows filtering policies by container name in the TracingPolicy CRD • TracingPolicy uprobe spec now uses the `symbols` array instead of the single `symbol` string field • TracingPolicy `post.actions` supports `kernelStackTrace: true` to enable kernel stack traces, replacing the old `stackTrace` field • Redaction filters are available in TracingPolicy `event_redaction_filters` to censor sensitive string data in process events • Export filters support a new filter type for process capabilities via the `capabilities` export filter Breaking changes: • The Helm value `tetragonOperator.skipCRDCreation` is removed; use `crds.installMethod=none` instead. • In TracingPolicy, the uprobe spec field `symbol` (string) is replaced with `symbols` (array of strings). • TracingPolicy `killers` are renamed to `enforcers`; update policies to use `enforcers` and set `action: NotifyEnforcer`. • In TracingPolicy, the stack trace field `stackTrace` is replaced with `kernelStackTrace` in post actions. • The protobuf API field `pod.labels` is removed; use `pod.pod_labels` instead. • The protobuf API event field `stack_trace` is renamed to `kernel_stack_trace` for kernel stack traces. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v1.0.1

Mon, 18 Dec 2023 18:09:53 GMT

Tetragon v1.0.1 adds a per-event missed events metric to detect dropped telemetry. • Adds a new `missed_events` metric (per-event) to expose dropped or lost telemetry data. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v1.0.0

Wed, 01 Nov 2023 09:11:46 GMT

Tetragon v1.0 adds process_exec uids/gids display, killer sensor, kernel stack traces, event type filtering, namespaced policies default, and metric label filters • `process_exec` events now display `uids/gids` credentials and detect privileged execution • Adds a new 'killer sensor' for process lifecycle detection • Adds an alpha feature to generate kernel stack traces for kprobe events • API events (`kprobe`, `tracepoint`, `uprobe`) now include the `policy_name` field • `getevents` CLI now supports filtering on event types via the new capability • Helm chart enables Namespaced policies and Pod label filters by default • Metric exporter now supports configuring labels for custom metrics Breaking changes: • Exported JSON files default to permissions `0600` instead of the previous default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v0.9.0

Mon, 03 Apr 2023 19:02:59 GMT

Tetragon v0.9.0 adds field filters for CLI and configmap, unix socket gRPC support, pprof, tarball deployment, and cgroups tracking • `--rb-size` and `--rb-size-total` CLI flags to configure BPF perf ring buffer size. • Add field filters to the CLI and Tetragon configmap to filter event fields. • Support for using Unix socket for gRPC communication instead of TCP. • Add pprof HTTP support for runtime profiling via standard pprof endpoints. • Tarball deployment support as an alternative to Kubernetes/Helm installation. • Basic cgroups tracking and correlation with execve events for process context. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v0.8.4

Fri, 03 Mar 2023 10:30:53 GMT

Tetragon v0.8.4 adds `--rb-size` CLI flags, field filtering in CLI/configmap, and configurable event queue size. • Adds `--rb-size` and `--rb-size-total` CLI options to the Tetragon agent for configuring perf ring buffer sizes • Adds field filter support to both the CLI output command and the Tetragon configmap to limit returned event fields Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v0.8.3

Thu, 20 Oct 2022 18:03:58 GMT

Tetragon v0.8.3 adds tracing for kernel capability checks, supports building on ARM, and introduces the `getevents` stdin mode in the CLI • `tracing: trace capability checks performed by the kernel on X access` • `tetra: Implement getevents stdin mode` • `add InMap operator for filtering arguments` • `Add Override type in ActionSelector` • `build tetra CLI for linux arm64 and windows amd64/arm64` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v0.8.1

Mon, 19 Sep 2022 16:34:45 GMT

Adds `-cpuprofile`, `memprofile`, and configurable gRPC/metrics ports; adds pod and argument regex filters. • Adds `-cpuprofile` flag to the observer binary for CPU profiling • Adds `observer.metrics.grpcAddress` and `observer.metrics.grpcPort` config keys via Helm to configure the gRPC metrics endpoint • Adds `arguments_regex` filter capability to TracingPolicy selectors for matching exec arguments against a regex pattern • Adds `pod_label_filter` capability to TracingPolicy selectors for matching events against pod labels Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon

tetragon v0.8.0

Fri, 13 May 2022 17:59:53 GMT

Tetragon v0.8.0 is the initial release of eBPF-based security observability and runtime enforcement for Kubernetes. • Initial release of Tetragon, a cyber tooling component for real-time detection of process execution, privilege changes, and I/O activity using eBPF. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tetragon