# tetragon snippets

```plaintext
this is process logs that will collected by ebpf system


{
  "process_exec": {
    "process": {
      "exec_id": "aXAtMTkyLTE2OC0yNi00Mi5lYzIuaW50ZXJuYWw6MTE0MDc1MTE4MzczNTo5NTYy",
      "pid": 9562,
      "uid": 0,
      "cwd": "/",
      "binary": "/usr/bin/sleep",
      "arguments": "infinity",
      "flags": "execve rootcwd clone inInitTree",
      "start_time": "2025-09-06T14:15:23.429928979Z",
      "auid": 4294967295,
      "pod": {
        "namespace": "default",
        "name": "sleepy",
        "container": {
          "id": "containerd://0220ba0f817a9075e33063e5f088dac22eaa11b46842b42e1f0f70044f615f15",
          "name": "sleepy",
          "image": {
            "id": "docker.io/library/ubuntu@sha256:9cbed754112939e914291337b5e554b07ad7c392491dba6daf25eef1332a22e8",
            "name": "docker.io/library/ubuntu:latest"
          },
          "start_time": "2025-09-06T14:15:23Z",
          "pid": 1,
          "security_context": {}
        },
        "pod_labels": {
          "run": "sleepy"
        },
        "workload": "sleepy",
        "workload_kind": "Pod"
      },
      "docker": "0220ba0f817a9075e33063e5f088dac",
      "parent_exec_id": "aXAtMTkyLTE2OC0yNi00Mi5lYzIuaW50ZXJuYWw6MTEzODgzMzE2OTQ1Mjo5NDk4",
      "tid": 9562,
      "in_init_tree": true
    },
    "parent": {
      "exec_id": "aXAtMTkyLTE2OC0yNi00Mi5lYzIuaW50ZXJuYWw6MTEzODgzMzE2OTQ1Mjo5NDk4",
      "pid": 9498,
      "uid": 0,
      "cwd": "/run/containerd/io.containerd.runtime.v2.task/k8s.io/acbdc0ff29ff8d29aff06385a8e9b5bd4ca80fc626e3a683d743d2923db225d6",
      "binary": "/usr/bin/containerd-shim-runc-v2",
      "arguments": "-namespace k8s.io -id acbdc0ff29ff8d29aff06385a8e9b5bd4ca80fc626e3a683d743d2923db225d6 -address /run/containerd/containerd.sock",
      "flags": "execve clone",
      "start_time": "2025-09-06T14:15:21.511914007Z",
      "auid": 4294967295,
      "parent_exec_id": "aXAtMTkyLTE2OC0yNi00Mi5lYzIuaW50ZXJuYWw6MTEzODgyMzEwNDUyMzo5NDg5",
      "tid": 9498,
      "in_init_tree": false
    }
  },
  "node_name": "ip-192-168-26-42.ec2.internal",
  "time": "2025-09-06T14:15:23.429928417Z",
  "node_labels": {
    "alpha.eksctl.io/cluster-name": "myeks-8",
    "alpha.eksctl.io/nodegroup-name": "ng-fb6baf33",
    "beta.kubernetes.io/arch": "amd64",
    "beta.kubernetes.io/instance-type": "t3.medium",
    "beta.kubernetes.io/os": "linux",
    "eks.amazonaws.com/capacityType": "ON_DEMAND",
    "eks.amazonaws.com/nodegroup": "ng-fb6baf33",
    "eks.amazonaws.com/nodegroup-image": "ami-0329ac7d12d171324",
    "eks.amazonaws.com/sourceLaunchTemplateId": "lt-0d5f20521207a4f85",
    "eks.amazonaws.com/sourceLaunchTemplateVersion": "1",
    "failure-domain.beta.kubernetes.io/region": "us-east-1",
    "failure-domain.beta.kubernetes.io/zone": "us-east-1a",
    "k8s.io/cloud-provider-aws": "a45db77541dc5d0a0f1385074b60166a",
    "kubernetes.io/arch": "amd64",
    "kubernetes.io/hostname": "ip-192-168-26-42.ec2.internal",
    "kubernetes.io/os": "linux",
    "node.kubernetes.io/instance-type": "t3.medium",
    "topology.ebs.csi.aws.com/zone": "us-east-1a",
    "topology.k8s.aws/zone-id": "use1-az1",
    "topology.kubernetes.io/region": "us-east-1",
    "topology.kubernetes.io/zone": "us-east-1a"
  }
}
```

  

Here are the **most important fields to keep** when designing policies around enforcement:

---

### 🔹 Process & Execution Context

* `process.binary` → the actual executable (`/usr/bin/sleep`, `/bin/bash`, etc.)
    
* `process.arguments` → arguments passed to the binary (e.g., `sleep infinity`)
    
* `process.uid` → which user ran the process (`0` = root)
    
* `process.cwd` → working directory (sometimes important for distinguishing behavior)
    
* `process.flags` → useful for detecting execve, setuid, init process, etc.
    

---

### 🔹 Container / Pod Context

* `process.pod.namespace` → Kubernetes namespace
    
* [`process.pod.name`](http://process.pod.name) → Pod name
    
* [`process.pod.container.name`](http://process.pod.container.name) → Container name
    
* [`process.pod.container.image.name`](http://process.pod.container.image.name) → Image name ([`docker.io/library/ubuntu:latest`](http://docker.io/library/ubuntu:latest))
    
* `process.pod.pod_labels` → Kubernetes labels (for selecting workloads via policies)
    
* `process.pod.workload_kind` → Pod, Deployment, DaemonSet, etc.
    

---

### 🔹 Parent Process Context

* `parent.binary` → helps detect container runtimes or unexpected parent processes
    
* `parent.exec_id` → trace lineage of execution
    

---

### 🔹 Node / Cluster Context

* `node_name` → node where the event occurred
    
* `node_labels` → useful for scoping policies to node groups, zones, instance types, etc.
    

---

### 🔹 Event Metadata

* `time` → event timestamp (critical for audit trails)
    
* `process.exec_id` → unique identifier for correlation
    
* `parent_exec_id` → trace back execution chains
    

---

✅ **In practice**, the *core fields* most often used for enforcement are:

* **Binary / arguments**
    
* **Pod namespace / name / labels**
    
* **Container image**
    
* **User (UID)**
    
* **Parent binary**
    
* **Node name** (if node-specific policies are needed)
    

install tetragon CLI and move its binary to /usr/loval/bin/

```plaintext
# Download the latest tetra (Linux x86_64 example)
curl -L https://github.com/cilium/tetragon/releases/latest/download/tetra-linux-amd64.tar.gz -o tetra.tar.gz

# Extract and move to /usr/local/bin
tar -xvf tetra.tar.gz
sudo mv tetra /usr/local/bin/

# Verify
tetra version
```

now check logs

```plaintext
kubectl logs -f -n kube-system ds/tetragon -c export-stdout | tetra getevents -o compact
```