Skip to content

Commit

Permalink
Updated download links for packages in readme file.
Browse files Browse the repository at this point in the history
  • Loading branch information
dirk29 committed Oct 14, 2024
1 parent c159534 commit 77be0a3
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@
## Kernel-based Process Monitoring on Linux Endpoints via eBPF

### kflowd runs as agent on Linux endpoints to monitor processes via eBPF kernel subsystem for filesystem and TCP and UDP networking events, enabling immediate threat and anomaly detection on suspicious activities.
#### Advanced non-ebpf related features such as DNS, HTTP and SYSLOG application message decoding, checksum calculation for virus detection, process and file versioning for vulnerability detection and file device, network interface and user-group identification for files and processes can be enabled via open-binary plugin modules. These modules as well as pre-built kflowd packages can be downloaded from the links below or please contact us at [[email protected]](mailto:[email protected]) for more details.
- [kflowd binaries and packages (zipped, RPM, DEB)](https://github.com/tarsal-oss/kflowd/actions/workflows/kflowd-ci.yml)
- [kflowd-plugins packages (RPM, DEB)](https://tarsal.co/kflowd-download/)
#### Advanced non-ebpf related features such as DNS, HTTP and SYSLOG application message decoding, checksum calculation for virus detection, process and file versioning for vulnerability detection and file device, network interface and user-group identification for files and processes can be enabled via open-binary plugin modules.<br>Pre-built kflowd and kflowd-plugins packages can be downloaded for quick installation from the [Releases](https://github.com/tarsal-oss/kflowd/releases) section.

If you would like to join our community Slack channel please send an email to [[email protected]](mailto:[email protected]) to receive an invitation. You can also contact us directly at [[email protected]](mailto:kflow@tarsal.co) for any questions.

kflowd contains an eBPF program running in kernel context and its control application running in userspace.<br>
The eBPF program traces kernel functions to monitor processes based on file system and networking events. Events are aggregated into records and submitted into a ringbuffer where they are polled by the userspace control application. All Records are enriched with process information and then converted into a message in JSON output format.<br>
Expand All @@ -29,7 +29,7 @@ kflowd runs on Linux kernels 5.10+ and is built with the **libbpf+CO-RE** (Compi

### JSON Output

kflowd outputs JSON messages generated for each record of aggregated file system and TCP, UDP networking events and optionally DNS and HTTP application messages in the formats as shown in the following examples:
kflowd outputs JSON messages generated for each record of aggregated file system and TCP, UDP networking events and optionally DNS, HTTP and SYSLOG application messages in the formats as shown in the following examples:

<details open>
<summary>&nbsp;Filesystem Record</summary>
Expand Down

0 comments on commit 77be0a3

Please sign in to comment.