Tetragon eBPF Runtime Security Observability | cloudimg Support

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Tetragon is Cilium's eBPF-based runtime security observability and enforcement engine, a CNCF project trusted across the cloud-native ecosystem. This AMI delivers a fully hardened, production-ready Tetragon host agent so your team gains kernel-level visibility into process execution, file access, network activity and privileged system calls without spending hours on manual deployment and lockdown.

The current release available is Tetragon 1.7.0.

• Pinned upstream release - the official Tetragon 1.7.0 release tarball, verified against the project's published SHA256 checksum, installed as a standard systemd service.
• Meaningful events from first boot - a default TracingPolicy set monitors reads of sensitive files (/etc/shadow, /etc/sudoers, /root/.ssh), writes to system binary and configuration directories, and setuid privileged syscalls, on top of Tetragon's always-on process execution and exit events.
• Structured JSON export - events are written to /var/log/tetragon/tetragon.log for your log shipper, SIEM or CI pipeline, and can be streamed live with tetra getevents.
• Provable on your own instance - a bundled self-test triggers a monitored action and confirms the matching event is produced, so you can verify the engine works end to end before relying on it.
• Extensible policies - drop your own TracingPolicy YAML files into /etc/tetragon/tetragon.tp.d/ and restart the service to extend or tighten what the host observes.

The gRPC control interface is a loopback-only unix socket, metrics and profiling endpoints are disabled, and the health port is pinned to loopback and additionally guarded by an nftables rule so it is never reachable off-box. SSH with your launch key is the only open port. The image ships no default credential of any kind, unattended security upgrades are enabled, and the OS is fully patched at capture.

• Fetching and checksum-verifying the upstream release and wiring it into systemd
• Writing a hardened daemon configuration and an initial monitoring policy set
• Locking down the gRPC control socket and the health port
• Proving end to end that a monitored action actually produces an event
• Ongoing maintenance and security patching without expert guidance

Security-conscious SaaS teams running single-tenant instances - monitor each customer-facing host for unauthorized credential reads or binary modifications without deploying a full Kubernetes stack. Structured JSON events feed directly into your existing SIEM.

DevOps teams operating bastion hosts or CI runners - detect unexpected process execution or privilege escalation on infrastructure hosts that sit outside your container orchestration layer. The self-test proves coverage is active after every deployment.

Compliance-driven organizations preparing for audits - gain kernel-level evidence of file-access patterns and privileged syscall usage to satisfy auditor requests for runtime monitoring controls, with events exportable to any log pipeline.

24/7 technical support by email and live chat with a one-hour average response for critical issues. Our engineers help with deployment, writing and tuning TracingPolicies, shipping events to your SIEM, and scaling across your fleet.

For detailed TracingPolicy examples, event schema documentation and deployment guidance, see the official Tetragon documentation at tetragon.io/docs.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.