Cloud Detection &
Response Platform

eBPF (extended Berkeley Packet Filter) lets TigerGate attach lightweight programs directly to the Linux kernel, capturing every system call, network connection, file operation, and privilege change without adding kernel modules or modifying application code. This gives you complete, tamper-resistant visibility at kernel speed with less than 3% CPU overhead. Because eBPF programs run in a verified sandbox inside the kernel, there is no risk of crashing the host — unlike traditional kernel module approaches.

No code changes are required. The lightweight eBPF agent deploys as a DaemonSet on Kubernetes, a Docker sidecar, an ECS task, or a systemd service on bare metal and VMs. Deployment typically takes under five minutes and works on any Linux distribution running kernel 4.15 or later. LSM-based enforcement (the ability to actively block threats, not just log them) is available on kernel 5.7 and later.

TigerGate detects crypto mining (unexpected process execution such as xmrig), privilege escalation (setuid/setgid attempts, capability abuse), lateral movement (anomalous SSH connections, unexpected network flows to internal hosts), container escape attempts, file integrity violations on sensitive paths like /etc/crontab, and process behavioral anomalies such as a web process spawning an interactive shell. All detections are mapped to MITRE ATT&CK tactics and techniques.

In audit mode TigerGate logs all policy violations and sends alerts but does not block any actions — this is the recommended starting point to tune policies and build baselines without affecting production traffic. In enforce mode the eBPF LSM hooks actively block violating system calls in real time, for example preventing an unauthorized binary from executing or stopping a privilege escalation before it completes. You can switch modes per workload or namespace without redeploying the agent.

Raw eBPF events can generate high volumes of individual signals. TigerGate groups related events into incidents using AI-powered correlation — for example, a suspicious outbound connection, a subsequent execve of a mining binary, and a setuid attempt within the same container are merged into a single high-confidence crypto-mining alert with a full timeline. This eliminates redundant notifications and surfaces one contextual alert per attack chain instead of hundreds of individual low-level events.

Yes. The eBPF agent maintains a continuous, tamper-proof audit trail covering process execution events, network flows, privilege changes, and file integrity evidence. This evidence is automatically mapped to controls in SOC 2, ISO 27001, PCI-DSS, GDPR, HIPAA, FedRAMP, NIST 800-53, CIS Benchmarks, and 35+ other frameworks. Real-time compliance dashboards show current posture, and the full event replay capability lets auditors reconstruct exactly what happened during any time window.