Tetragon
Embed
<a href="https://forumulate.com/p/watchtower/docs/tetragon"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/c8477f88-89e1-4042-a076-48be523505db/social-card.svg?v=3e7ae33eec8b" alt="Tetragon" width="600" height="315"></a>Create a tetragon security source. Tetragon writes JSON export events; ship them with any log forwarder that can POST JSON (Vector or Fluent Bit, for example) to https://<edge>/v1/security/<source_id> with the secret as a Bearer token. A body may be one event, an array or NDJSON.
Mapping: the event type (process_exec, process_exit, process_kprobe, process_tracepoint, process_loader) is the tag; the rule is the policy_name for kprobe and tracepoint events and the event type otherwise. Policy events are warning, process lifecycle events notice. From process: binary (process.executable.path), arguments, pod.namespace, pod.name, pod.container.id (the containerd:// prefix is removed); node_name is host.name.
Process lifecycle events are noisy and notice: they are dropped by the default warning filter. Keep them only for a narrow namespaces list.