Skip to content

Latest commit

 

History

History
27 lines (19 loc) · 611 Bytes

README.md

File metadata and controls

27 lines (19 loc) · 611 Bytes
Raw

eBPF Engine

Build

  1. Pull and build vendor libraries by running the following script:
./install_dependencies.sh

This step can take ~15 minutes depending on your machine.

  1. Build the engine:
mkdir ./build && cd build
cmake ..
make all

Run

sudo ./build/main -f "evt.type=execve or evt.type=execveat" -e ./dependencies/falco-libs/build/driver/bpf/probe.o

The command above will listen on all execve and execveat syscalls occuring in containers (by default we will print data only in containers).

Check out the available flags by running: ./build/main -h