The Platform

Runtime security at the kernel layer

Oligo loads eBPF programs into the Linux kernel without code changes or library instrumentation. Gain process visibility, dependency reachability, and sub-millisecond exploit blocking across your fleet.

Architecture

eBPF between your application and OS

No sidecars or library patches. Verified eBPF programs run in the kernel and send events to the Oligo agent through a high-throughput ring buffer.

Detection Coverage

What eBPF sees beyond scanning

Each detection cell maps to a kernel hook point. Alerts fire when behavior occurs, not when a CVE database says it might.

Unexpected Network Egress

Detect DNS or TCP connections from libraries outside approved domains, including JNDI and SSRF patterns.

Shell Spawn from Library

Detect execve calls from third-party packages, a core signal of active RCE exploitation.

File System Anomalies

Flag writes to /etc, /proc, or /tmp executables by packages with no reason to access the file system.

Memory Corruption Attempts

LSM hooks expose mmap/mprotect patterns linked to heap spray and return-oriented programming attacks.

Supply Chain Beaconing

Spot npm, PyPI, or Maven packages making C2 connections within milliseconds of process start.

Zero-Day Behavioral Patterns

Baseline deviation detects exploitation before CVE assignment through learned process call graphs.

Deployment

One DaemonSet per cluster

Oligo ships as a Kubernetes DaemonSet with a Helm chart. Its eBPF programs self-load, attach to every running process on the node, and emit events within 90 seconds of deployment. No restart or app changes required. Supports EKS, GKE, AKS, and bare metal.

Read the docs Request a demo deployment

Live Observability

Every alert includes process context

Alerts show the process tree, triggering library, exact syscall, and runtime call stack, so your team does not recreate context.

rule shell-spawn-from-oss-lib

process api-service / PID 24401 / node:18-alpine

library vm2 @ 3.9.18 (CVE-2023-30547)

syscall execve("/bin/sh", ["-c", "curl ..."])

action blocked + SIGKILL sent to child process

Matched: oss-shell-spawn-block

vm2 sandbox escape attempt detected. A library invoked execve from untrusted code evaluation. Process killed. Alert sent to SIEM.

See platform performance in your environment

Most teams are fully instrumented within one sprint. No application code changes or manual rule writing.

Request Access How It Works