Talk Beginner Elastic License 2.0 First Talk

ELF-OWL: Real-Time Kubernetes Runtime Security and CIS Compliance Automation via eBPF

Rejected

Session Description

Traditional Kubernetes security relies on deploy-time checks that miss runtime threats entirely. ELF-OWL closes this gap with a push-only, read-only agent that hooks ~20 kernel tracepoints across 6 eBPF monitors. Each raw kernel event is enriched with live Kubernetes metadata (Pod, Namespace, ServiceAccount, NetworkPolicy) and evaluated against a 46-control CIS v1.8 rule engine — configurable via YAML or ConfigMap without restarts. The pipeline batches, signs, and encrypts telemetry before forwarding it to HTTPS webhook endpoints, eliminating inbound C2 attack vectors entirely. ELF-OWL is designed for progressive adoption: start in mirror/observe mode, tune rules, then enforce via GitOps integration.

References

https://github.com/cloudarmour-io/ElfOwl?tab=readme-ov-file

Session Categories

Technology / FOSS licenses, policy

Talk License: Elastic License 2.0

Which track are you applying for?

Cloud & DevOps

Speakers

Nitin jangra System Engineer | CloudArmour

As a System Engineer at CloudArmour, he build networking and security solutions focused on L3/L4/L7 traffic processing, eBPF, NFtables, and cloud infrastructure. he works with Go, Rust, and C to develop high-performance backend and system-level applications, with a strong focus on Linux networking, firewall technologies, and observability.
Previously, he developed an eBPF-based L7 firewall, secure API systems, and automation tools at Udyansh. he is passionate about Linux kernel technologies, network security, distributed systems, and building scalable infrastructure from the kernel to the cloud.
Core Technologies: eBPF • NFtables • Go • Rust • C • Linux Networking • Cloud • PostgreSQL • Redis

https://www.linkedin.com/in/nitin-jangra-48401636b/