Tetragon

What it is

A Cilium project that hooks into the Linux kernel and applies policy right where events happen. Filtering, blocking, and reactions run in kernel space instead of in a user space agent, which keeps overhead low on busy hosts.

What it helps with

- Recording process execution, system calls, and file or network access
- Tying events to Kubernetes namespaces and pods
- Killing a process that breaks policy before its system call completes
- Writing custom tracing policies for any kernel function

Who it's for

Platform, cloud, and security teams running Kubernetes or Linux hosts that need runtime visibility and enforcement.

Worth knowing

In our view, where Falco mainly detects and alerts on suspicious behavior, Tetragon can also enforce policy inside the kernel. It ships with example tracing policies that serve as starting points.

Does it need Kubernetes?
No, it also runs on plain Linux hosts, though it gains workload context in a cluster.

How does it relate to Kubescape?
In our view they complement each other, with Kubescape checking cluster posture and Tetragon watching runtime behavior.

Is there a command line client?
Yes, the tetra CLI is released for Linux, macOS, and Windows to read events.