Elf-Owl.
Kubernetes, continuously observed.
Read-only, push-only compliance agent with eBPF runtime security monitoring for CIS Kubernetes v1.8 detection. Kernel-native visibility, zero enforcement, signed and encrypted evidence.
Minimal observer. Maximum evidence.
Elf-Owl is a minimal compliance observer that detects CIS Kubernetes v1.8 violations using cilium/ebpf kernel monitoring. The agent runs as a read-only DaemonSet with zero enforcement capability, collecting and pushing signed, encrypted evidence to the Owl SaaS platform in a secure, one-way outbound architecture.
Monitors process exec, network connections, DNS queries, file ops, and Linux capabilities directly from the kernel.
46 automated control mappings detect violations across processes, containers, networking, and RBAC.
Read-only + push-only. Zero enforcement, no inbound command channels. Perfect for regulated industries.
Simple, safe, scalable pipeline.
Single-direction data flow. No inbound commands. No cluster modifications. No enforcement hooks. Pure observability with cryptographic guarantees.
Process · Network · DNS · File · Capability
Container ID · Pod · Node · RBAC context
Matching & evaluation
HMAC + AES · buffer & batch
One-way, outbound only
Compliance monitoring without overhead.
Cloud-native compliance monitoring that installs in minutes and stays out of the way.
Process exec, network connections, DNS queries, file operations, and Linux capability checks — all instrumented with kernel-level precision.
46 automated control mappings detect privileged containers, root execution, and network policy violations. 9 manual references flag policy-heavy controls.
In-cluster metadata enrichment with pod namespaces, labels, and node info. Container ID to pod mapping and RBAC context scoring built in.
HMAC-SHA256 signing for integrity, AES-256-GCM encryption for confidentiality, gzip batching, and automatic retry logic.
Health endpoint exposing uptime and monitor status. Prometheus metrics track violations and push latency. Structured logging for audit trails.
DaemonSet with Helm charts and Kustomize overlays. Read-only RBAC, minimal permissions, zero enforcement ensure safe rollouts.
From audit burden to audit confidence.
Continuous, cryptographically-attestable evidence — no manual reviewer overhead.
Automated detection eliminates manual reviewer overhead
Automated detection of 46 CIS controls. Signed, encrypted evidence provides immutable audit trails for SOC 2, ISO 27001, and PCI-DSS assessments.
A fintech firm reduces audit response time from 2 weeks to 2 hours with automated violation reports and evidence logs.
Catches what configuration management can't
eBPF detects process anomalies, capability abuse, and file access patterns. Flags deviations from policy intent with pod-level precision.
A healthcare provider catches an app container attempting to execute setuid binaries and logs evidence for immediate investigation.
Read-only + push-only eliminates tampering concerns
Cryptographic signing ensures auditors trust the integrity of collected data end-to-end.
A regulated environment passes unannounced audits by proving through signed logs that no compliance controls were ever disabled or bypassed.
Deploy in minutes with Helm or Kustomize.
Ship as a read-only DaemonSet. No enforcement surface, no inbound channels — just evidence.
helm install Elf-Owl ./deploy/helm \
--namespace elf-owl-system \
--create-namespace \
--set clusterID=prod-us-east-1 \
--set owlAPIEndpoint=https://owl-saas.example.com
kubectl apply -k deploy/kustomize/overlays/production/
| OWL_CLUSTER_ID | Cluster identifier |
|---|---|
| OWL_NODE_NAME | Node name (auto-populated) |
| OWL_API_ENDPOINT | Owl SaaS endpoint URL |
| OWL_JWT_TOKEN | JWT token for authentication |
| OWL_LOG_LEVEL | Log level (debug, info, warn, error) |
Health & metrics, out of the box.
Standard endpoints for integration with your monitoring stack.
{
"agent_version": "0.1.0",
"uptime": "1h23m45s",
"status": "healthy",
"events_processed": 1523,
"violations_found": 42,
"monitors": {
"process": true,
"network": true,
"dns": true,
"file": true,
"capability": true
}
}
- elf_owl_events_processed_total
Total events processed by the agent - elf_owl_violations_found_total
Total CIS violations detected - elf_owl_events_buffered
Current evidence buffer depth - elf_owl_push_latency_seconds
Push operation latency histogram - elf_owl_enrichment_errors_total
Errors during K8s/container correlation - elf_owl_host_events_discarded_total
Host events discarded (kubernetes_only mode)
46 automated controls. 9 manual references.
Elf-Owl maps and detects compliance against CIS Kubernetes v1.8 benchmarks. Automated controls leverage eBPF and K8s API queries; manual controls are flagged for auditor review.
Detect privileged containers, root execution, Linux capability abuse, root filesystem writes, default ServiceAccount usage, and NetworkPolicy violations through eBPF and K8s metadata.
- CIS 4.5.1 · Privileged container detection
- CIS 4.5.2 · Root user execution detection
- CIS 4.5.3 · Linux capability usage
- CIS 4.1.1 · Default ServiceAccount detection
- CIS 4.6.1 · Default deny NetworkPolicy
API server, kubelet, and etcd configuration controls that require node-level access and human auditor review. Elf-Owl flags these for manual remediation.
- CIS 1.1–1.5 · API server configuration
- CIS 4.2 · Kubelet configuration
- · 7 policy-driven controls for auditor review
See config/rules/cis-controls.yaml and docs/remediation.md for complete mappings.