eBPF Execution Chain Telemetry & Tetragon Migration

Environment variables

EBPF_EXECUTION_CHAIN_ENABLED=true
EBPF_EVENTS_FILE=/var/log/ebpf_execution_events.jsonl
EBPF_MAX_EVENTS_PER_SCAN=5000

Finding mapping

• Maps kernel process execution events to execution_chain findings.
• Preserves process lineage and pod context in source metadata.
• Derives severity from action semantics (deny and kill are treated as high).
• Uses deterministic dedup keys to avoid duplicate finding creation on repeated scans.

Rollout guidance

• Start in observe mode to profile noisy workloads before enforcing deny actions.
• Retain event files with rotation so the scanner can consume recent activity windows.
• Correlate with native runtime_threat and workload inventory findings for triage context.