Lion Cipher Lab
Catch and kill malicious behavior at runtime with Tetragon (eBPF enforcement)
- Cloud Security
- Intermediate
- ~75 min
- Free · no account required
Why it matters
The Falco lab taught you the first move of runtime defense: watch the live system and raise an alert the instant something looks wrong. That is detection, and detection is essential — but an alert is a message to a human who may be asleep. Between the alert firing and someone acting, the attacker keeps going: reads the credentials file, opens the reverse shell, ships the data out. Tetragon closes that gap. It is an eBPF-based runtime security tool from the Cilium project (CNCF) that loads tiny programs directly into the Linux kernel, so it sees every process launch, file open, network…
What you'll learn
- what eBPF-based runtime enforcement is (in-kernel programs that see and can BLOCK behaviour)
- deploying Tetragon on a local kind Kubernetes cluster with Helm
- streaming live events with `tetra getevents` and reading full process ancestry (who spawned what)
- watching real process-exec, file-access and network events without the workload cooperating
- writing a TracingPolicy (the CRD) that matches one specific behaviour
- the observe-then-enforce discipline: run in audit mode, tune, THEN add a Sigkill action
- proving in-kernel enforcement: a process killed the instant it touches /etc/shadow, not merely logged
- judging when Tetragon vs Falco vs an admission controller — and the honest limits of enforcement
Steps in this lab
- From 'tell me' to 'stop it': what eBPF enforcement adds over an alert
- Where enforcement fits: build-time, admission-time, runtime — pick the right layer
- Build a throwaway kind cluster and install the tools
- Observe first: stream live events and read the process ancestry
- Watch a sensitive file access specifically
- Write a TracingPolicy that matches ONE behaviour — in observe mode
- ENFORCE: add a Sigkill action and prove the process dies in-kernel
- The judgment: blast radius, what enforcement is NOT, and Tetragon vs Falco vs admission control