bomfather/agent

eBPF Security Monitoring and Sandboxing Agent Based on Aya

Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities

Hardens eBPF tools against privileged attackers via policy-based access controls

eBPF-based Security Observability and Runtime Enforcement

eBPF LSM based Mandatory Access Control and jailer

Linux Runtime Security and Forensics using eBPF

Jailer is an eBPF-based process jailing system that provides mandatory access control (MAC) for Linux. It tracks processes using BPF task_storage maps and enforces role-based policies on file access, network operations, and process execution.

Rust library for writing Linux security policies using eBPF

A modular and blazing fast runtime security tool for the IoT, powered by eBPF.