Triaging Real-time Security Threats with eBPF-powered Observability
summary
Claims that Pixie + eBPF gives kernel-level, agentless observability that shortens triage cycles and removes guesswork; it captures raw DNS queries, full HTTP traces, process exec capture, flame graphs and raw SQL so exfiltration via DNS or successful SQL injection shows exact queries and return values. The team applies Pixie during Log4j response, scripts additional probes on the fly, and reports that combining traditional APM with eBPF-based dynamic traces speeds impact assessment and confirms whether services are truly unaffected.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:44Robert Prast
- 1:52New Relic Security Team
- 2:09What we do?
- 2:50What type of incidents do we deal with?
- 3:46How we make big decisions
- 4:52Our Incident Response
- 5:54Remote Code Execution
- 6:38Assessing Impact of Log4j
- 8:43Using Traditional Observability
- 9:36Rigid Data Collection
- 10:21Static and Predictable 011y
- 11:12Determining Source of Truth
- 11:57Scary Security Scenario
- 13:48KERNEL NEVER LIES
- 14:40Pixie is an observability platform for developers
- 15:00Observing the many layers of the system
- 16:31Figuring out if an attacker did bad stuff with Pixie
- 21:11Traditional + Dynamic Observability
- 22:01Paradigm Shift for Security
- 24:09Faster MTTR
related talks
17meBPF in Microservices Observability
25mExpanding eBPF’s Reach: From Batteries-Included Auto-Instrumentation To E2E Observability Pipelines
30mObservability in Kubernetes: Unlocking the Power of eBPF
28mBpftrace Meets Pixie: Dynamic Monitoring of K8s Clusters Unleashed
14mFlexible, Open and Easy Observability for Developers
10mLightning Talks: Detecting Data Exfiltration on the Edge with Pixie
36meBPF for Runtime Security
29mReproducing Production Issues in your CI Pipeline Using eBPF