Behavior, provenance & eBPF

Continuous observation

Default cadences are 30 seconds for process and connection sampling, five minutes for integrity sweeps and 60 minutes for configurable repository checks. The workbench surfaces stale telemetry, missed sweeps and spool overflow rather than treating missing data as healthy.

Identify the execution

Executable hashes, supported script operands, mapped libraries and network namespaces participate in behavioral identity. Unreadable, replaced, deleted or unverifiable files retain explicit uncertainty. Approve known-good identities deliberately and review changed identities again.

Optional deeper capture

Opt-in eBPF execution capture adds visibility into short-lived processes. File-write and execution triggers complement recurring scoped scanning. Kernel support, collector permissions and coverage vary; validate them on your target platforms.

Separate current health from retained history

Collector diagnostics identify the current capture run and retain earlier warnings with their retirement reason and time. Recovery, an intentional disable or a new run retires a superseded warning; a current warning or an unexplained coverage gap still needs attention. Process identities accept Linux’s valid zero start tick while rejecting malformed or changed identity fields.

Follow the delivery path

Durable bounded batches retain collected observations until central acknowledgement. Inspect queued bytes, backlog age and reasoned loss history through the event delivery and spool health guide. Current telemetry and historical loss are separate signals.

Interpret the evidence