Documentation

Run Oligo in your cluster

Most production deployments take under 20 minutes. This page covers the quickstart. Customers can access full reference docs in the console.

1. Prerequisites

Oligo needs Linux kernel 4.18 or later with BTF available. Most modern distributions include BTF. Check with:

# Check kernel version
uname -r
# Verify BTF is available
ls /sys/kernel/btf/vmlinux

Supported Kubernetes distributions: EKS 1.24+, GKE 1.24+, AKS 1.24+, and self-managed clusters with kernel 4.18+. The DaemonSet needs a privileged pod security context.

2. Install with Helm

Add Oligo's Helm repo and install the DaemonSet in the oligo-system namespace:

helm repo add oligo https://charts.oligosec.org
helm repo update

helm install oligo-agent oligo/oligo-agent \
  --namespace oligo-system \
  --create-namespace \
  --set apiKey=YOUR_API_KEY \
  --set mode=monitor

The mode=monitor flag enables observe-only mode. Oligo blocks no traffic until blocking policies are enabled. Find your API key in the console after account provisioning.

3. Verify Instrumentation

After the DaemonSet starts, verify that eBPF probes attached to running processes:

# Check DaemonSet status
kubectl get daemonset -n oligo-system

# View agent startup logs
kubectl logs -n oligo-system -l app=oligo-agent --tail=30

Expected output resembles: INFO eBPF probes attached to N processes. Probes usually attach within 60-90 seconds of pod start.

4. Your First Alert

Oligo emits events immediately. The console displays a live dependency graph for each instrumented workload. To create a test alert:

# Trigger a test alert from the CLI
oligo-cli test-alert \
  --type shell-spawn \
  --cluster production-k8s \
  --namespace default

# Outputs alert ID and confirms delivery to configured webhook

Behavioral Policies

Behavioral policies specify actions Oligo should block or alert on. Scope policies to namespaces and target workloads by label selector.

apiVersion: oligo.io/v1alpha1
kind: BehaviorPolicy
metadata:
  name: block-shell-spawn
  namespace: production
spec:
  selector:
    matchLabels:
      app: api-service
  rules:
  - type: shell-spawn-from-oss
    action: block

Allowlists

Allowlists silence alerts for known-safe behavior. Use them to reduce noise from expected egress destinations or approved shell invocations.

apiVersion: oligo.io/v1alpha1
kind: AllowList
metadata:
  name: approved-egress
spec:
  entries:
  - type: network-egress
    destination: api.stripe.com
    library: stripe

Alert Destinations

Route alerts to multiple destinations at once, including webhook, Slack, PagerDuty, generic endpoints, SIEM via CEF/JSON, and the Oligo console.

# Configure Slack webhook destination
oligo-cli config set-destination \
  --type slack \
  --url https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK \
  --severity critical,high

Event Schema

Each Oligo event is a JSON object with a schema stable across minor versions. Key fields:

{
  "event_id": "evt_01HX9...",
  "type": "shell-spawn-from-oss",
  "severity": "critical",
  "process": { "pid": 24401, "name": "api-service" },
  "library": { "name": "vm2", "version": "3.9.18" },
  "syscall": "execve",
  "action_taken": "blocked",
  "timestamp": "2026-04-21T14:33:07Z"
}

Helm Values Reference

Key values for the oligo/oligo-agent Helm chart:

apiKey: ""              # Required. From your Oligo console.
mode: monitor          # monitor | enforce
image.tag: latest
resources.limits.cpu: 200m
resources.limits.memory: 128Mi
tolerations: []         # Add to schedule on tainted nodes
nodeSelector: {}

API and Integration Guide

Alert Webhook

POST HMAC-signed alerts to your SIEM, PagerDuty, or custom endpoint with the full event schema.

Policy API

REST CRUD for behavioral policies with namespace and label selectors for scoped enforcement.

Dependency Graph API

Query a workload's runtime dependency graph for loaded packages, called code paths, and reachability scores.

Metrics Endpoint

Prometheus-compatible metrics from the Oligo agent: probe overhead, event throughput, alert latency histograms.

Need deployment help? We will walk through it together.

Every new customer gets a technical onboarding call. We review your cluster configuration and help tune initial policies for your workload.

Request Access See the Platform