How It Works
Kernel hook to blocked exploit, sub-millisecond
Four hooks. One ring buffer. A behavioral engine learns normal activity and flags meaningful deviations.
eBPF Hook Points
Where Oligo hooks into the kernel
Each hook reveals a different view of process behavior. Oligo runs all four together for broad coverage.
kprobe
Kernel Function Probes
Captures: syscall entry and return, kernel arguments, return values
Used for: exec detection, socket creation, file opens and writes
uprobe
User Space Probes
Captures: calls within user-space binaries and shared libraries
Used for: library tracing, JNDI lookups, deserialization triggers, crypto operations
tracepoint
Kernel Tracepoints
Captures: stable kernel events across scheduler, networking, security subsystems
Used for: TCP connect, socket accept, process lifecycle, and cgroup operations
LSM
Linux Security Module Hooks
Captures: security-relevant operations before the kernel grants or denies them
Used for: file, network, and exec policy enforcement, plus mmap control
Signal Pipeline
From kernel event to high-fidelity alert
Every event moves through four stages before becoming an alert, with noise removed at each layer.
01 Collect
eBPF programs write structured events to a per-CPU ring buffer. Overhead: under 2% CPU on typical workloads.
02 Attribute
Each event maps to its process, container, and the third-party library behind the syscall.
03 Correlate
Events are checked against the runtime dependency graph and behavioral baseline. Normal activity is suppressed.
04 Alert
Anomalous events become structured alerts with process context, CVSS score, and a recommended remediation path.
Comparison
Oligo vs traditional security methods
Static scans and DAST show a point-in-time view. Oligo shows what is actually running.
| Capability | Oligo Runtime | SAST / SCA | DAST | WAF |
|---|---|---|---|---|
| Detects reachable CVEs only | ✓ | ✗ all CVEs | ✗ | ✗ |
| Zero-day behavioral detection | ✓ | ✗ | ✗ | partial |
| No code change required | ✓ | ✓ | ✓ | ✓ |
| Works on compiled / JIT runtimes | ✓ | limited | ✗ | ✗ |
| Detects supply-chain malware at execution | ✓ | ✗ | ✗ | ✗ |
| Blocks exploits in real time | ✓ | ✗ | ✗ | HTTP layer only |
| Alert noise at scale | Very low | Very high | Medium | High |
See how deep eBPF visibility changes your security posture
Deploy on one cluster. See results in the first hour.