bombini

Bombini is an eBPF-based agent for (mostly) security monitoring. Bombini provides components for fast prototyping eBPF detectors. Not all components are implemented yet and it's more like proof of concept for now. It is build on a top of Aya library. Design concepts can be found here.

Prerequisites

1. Install Rust.
2. Prepare environment for Aya.

Build

cargo xtask build

Run

You can try bombini agent this way:

RUST_LOG=debug cargo xtask run -- --config-dir ./config --stdout

Also you can use file as output or unix socket combining with vector.

File

Start vector agent:

vector --config ./vector/vector-file.yaml

Start bombini with events redirecting to file:

RUST_LOG=debug cargo xtask run -- --config-dir ./config --event-log ./bombini.log

Unix socket

Start vector agent with unix socket listner:

vector --config ./vector/vector-sock.yaml

Start bombini with events redirecting to unix socket:

RUST_LOG=debug cargo xtask run -- --config-dir ./config --event-socket /tmp/bombini.sock