Probe reference

Nine probes. Each entry below states what it attaches to, what it produces, what it costs, and — most usefully — what stops working if you disable it.

sched_process_exec#

Attaches to the sched_process_exec tracepoint, with an fentry on bprm_execve where available. Produces OCSF 1007 Process Activity, activity_id: 1 (Launch).

Resolves the executable inode, which is where exec_from_memfd, exec_from_tmpfs and exec_deleted_binary come from. Also captures the full argv, the working directory, the effective capability set, and the cgroup path used to attribute the process to a container.

Overhead negligible. Exec is rare relative to other syscalls, even on a busy build host.

Disabling it breaks essentially all execution-based detection: reverse shells, fileless execution, container escape via nsenter, cryptominer argv matching, setuid execution, and the process tree in every incident view.

sched_process_exit#

Attaches to the sched_process_exit tracepoint. Produces OCSF 1007, activity_id: 2 (Terminate), with exit_code and exit_signal.

Overhead negligible.

Disabling it breaks process lifetime accounting and the ability to distinguish a process that finished from one still running at investigation time.

sys_enter_connect#

Attaches to the connect syscall entry. Produces OCSF 4001 Network Activity with syscall: "connect" and connection_info.direction_id: 2.

Also computes egress_to_internet by checking the destination against RFC1918 space and the cluster CIDRs, and crossed_pod_boundary from the source network namespace.

Overhead low. Proportional to connection rate; a service opening thousands of short-lived connections per second is the expensive case, which is what skip_loopback and CIDR exclusions are for.

Disabling it breaks C2 detection, IMDS access detection, lateral movement, exfiltration volume analytics and mining pool detection.

sys_enter_accept4#

Attaches to the accept4 syscall entry. Produces OCSF 4001 with direction_id: 1 (Inbound).

Overhead low.

Disabling it breaks the ability to distinguish a genuine listener from an egress connection — which matters because a reverse shell and a legitimate server both have a socket, and only the direction tells them apart.

file_open#

Attaches to security_file_open via BPF LSM where available; falls back to a kprobe on do_sys_openat2. Produces OCSF 1001 File System Activity.

The highest-volume probe by a wide margin, and therefore the one with the most tuning surface. It resolves path_class in-kernel — credential, persistence, anti-forensics, staging — which is what allows a credential-access rule to run everywhere without shipping every open.

Overhead moderate, and entirely dependent on filters. With the default exclusions on a typical node it is well under 0.3% of a core; with no filters on a build host it can be several percent.

Disabling it breaks credential access detection, persistence detection, anti-forensics detection, service-account token reads, and the staging half of exfiltration chains.

bpf#

Attaches to the bpf syscall. Produces OCSF 1003 Kernel Activity, activity_id: 5 (Invoke).

This is the probe that protects the detection. Attacker-loaded eBPF is used to hide processes, tamper with other sensors, and build kernel-resident C2.

Overhead negligible. bpf() is rare outside of the tools that legitimately use it.

Disabling it breaks rootkit detection, eBPF tampering detection, and the sensor's ability to notice something interfering with itself.

Requires BTF for reliable attachment. Without it the probe reports failed.

ptrace#

Attaches to the ptrace syscall. Produces OCSF 1003, with the request type in args.

Overhead negligible.

Disabling it breaks process injection detection and cross-process memory access detection — the in-memory half of credential theft.

module_load#

Attaches to init_module and finit_module. Produces OCSF 1005 Module Activity with module.type_id: 1 (LKM).

Overhead negligible.

Disabling it breaks kernel rootkit detection. Loading a module from a writable path is one of the highest-signal single events available on Linux.

dns#

Attaches to the socket send and receive path, parsing DNS wire format directly. Produces OCSF 4003 DNS Activity with the query and, optionally, answers.

Parsing on the socket path rather than hooking a resolver means it sees queries from statically-linked binaries and from anything using its own resolver — which is most malware.

Overhead low to moderate on DNS-heavy workloads. max_answers bounds the per-event cost.

Disabling it breaks DNS tunnelling detection, DGA detection, and the domain half of C2 detection.

Reading probe state#

Every heartbeat reports per-probe state:

probe_state:
  sched_process_exec:  attached
  file_open:           attached
  bpf:                 failed      # no BTF on this kernel
  dns:                 disabled    # by policy

Three states, three meanings:

• attached — working
• failed — the sensor tried and could not; a visibility gap
• disabled — policy turned it off; a deliberate visibility gap

The console distinguishes the last two, because "we chose not to look" and "we cannot look" are very different conversations to have with an auditor.