84 The Four Golden Signals of Security Observability
summary
Migrates claim: kernel eBPF instruments Linux syscalls to capture four concrete signals — Process Execution, Network Sockets, File Access, Layer 7 Network Identity — and Cilium wires those signals into observability and enforcement. Cilium implements in-kernel NAT and makes allow/deny decisions at the socket call, surfaces service-mesh style metrics in 1.12, and provides cluster-wide TCP-dump style traces via Hubble plus real-time detection and response using Tetragon to catch a live attack.
AI-written summary · about
chapters (9)
- 0:00Security observability intro
- 1:07What is eBPF
- 3:56Psylla as CNI
- 6:45Psylla networking & mesh
- 8:10Golden signals in mesh
- 9:55Identity-based network insights
- 10:15Hubble’s TCP view
- 11:41Network dependencies & policies
- 12:23Socket decisions & fast-path
related talks
22mOne Project, Different Angles: How to Secure and Observe with Cilium
31mBridging Dev and Ops with eBPF: Extending Observability Upwards and Downwards
44mCilium - Container Security and Networking Using BPF and XDP
33meBPF for Security
33mDetecting Compromised CI With eBPF and Cilium Tetragon
31m10 Years of Cilium: Connecting, Securing, and Simplifying the Cloud Nat...
37mScaling up and Scaling Out Networking, Observability, and Security...
27mInsightful Traffic Monitoring: Harnessing Cilium for Comprehensive Network Observability