Relational Observability for Cloud-Native Security and Data Science

Explore a comprehensive conference talk on SysFlow, a runtime observability framework for cloud-native security and data science. Delve into how SysFlow elevates system call events collected via eBPF into process behaviors, creating a powerful open telemetry format. Learn about its ability to record interactions between processes, containers, and Kubernetes pods with their environment, including network, filesystem, and inter-process communications. Discover how SysFlow's compact format enables the creation of stateful system behavioral graphs from streaming data, providing crucial context for security analysis. Understand how this framework addresses common issues in system call data collection, such as the lack of security semantics and excessive data volume. Gain insights into the full suite of open-source tools for collecting and processing SysFlow, including a self-contained library for creating SysFlow consumers, Python APIs, and an interactive Jupyter environment for security data science tasks. Witness a practical application of SysFlow in Kubernetes security monitoring, where declarative security policies identify attack behaviors and perform threat investigations using process-level provenance tracking in interactive playbooks.