Runtime threats don't wait for your next scan.
Kubesentry watches every process, syscall, and container event in your K8s clusters — and stops attacks at execution time, not after the fact.
Three steps from zero to runtime visibility.
No sidecar containers. No application code changes. Deploy in minutes with a single Helm command.
Deploy the eBPF agent
One Helm command installs the Kubesentry DaemonSet on every node. Works on EKS, GKE, AKS, and self-managed clusters.
Define policy rules
Write YAML policies — or import your existing Falco rules. The policy engine evaluates every event against your threat signatures.
Respond to alerts
Alerts route to Slack, PagerDuty, or your SIEM within 30 seconds P99. Every alert includes process tree, container ID, and namespace.
Six threat categories, kernel-level visibility.
Built on eBPF probes that intercept syscalls at the kernel level — before any application-layer defense can be bypassed.
Container Escape Detection
Detects namespace breakout attempts via unshare, chroot, and mount syscall patterns. Catches both known CVE patterns and novel techniques.
See detection detailsCryptomining Detection
Identifies mining processes by CPU usage anomaly, outbound connection to known mining pools, and process name heuristics — within seconds of execution.
See detection detailsLateral Movement
Tracks anomalous cross-namespace network connections and unauthorized access to Kubernetes service accounts that suggest east-west pivot attempts.
See detection detailsPrivilege Escalation
Monitors setuid/setgid calls, CAP_SYS_ADMIN usage, and attempts to write to /etc/passwd or sudoers from within containers.
See detection detailsSyscall Anomaly Baseline
Learns the normal syscall profile of each workload over 72 hours, then alerts when behavior deviates — catching zero-day exploitation patterns.
K8s Audit Log Analysis
Correlates Kubernetes API server audit events with container-level process activity to surface threats that span the API and runtime layers.
Kernel-level visibility, zero overhead.
eBPF probes attach directly to the Linux kernel syscall table — no sidecar containers, no app-code modifications, no performance penalty.
Works with your existing stack.
What K8s operators say.
"We went from 72-hour MTTD on container escapes to under 90 seconds. The eBPF DaemonSet was running in production within 10 minutes of helm install — no restarts, no sidecars to manage."
"We had Falco rules but no managed policy delivery or alert routing. Kubesentry took our existing rules and gave us the SIEM forwarding and 30-day retention we needed for our SOC 2 audit cycle."
"Alert noise was the main concern — our previous tool fired on every cron job. Kubesentry's syscall baseline learning period reduced false positives by roughly 85% in the first week."
Ready to see what's running in your cluster?
Deploy in minutes. No sidecar overhead. Falco-compatible.