{"repo":"exein-io/pulsar","free":true,"listed":false,"github":"https://github.com/exein-io/pulsar","clone":"git clone https://github.com/exein-io/pulsar.git","description":"A modular and blazing fast runtime security tool for the IoT, powered by eBPF.","language":"Rust","stars":1038,"topics":["ebpf","kernel","linux","rust","security"],"license":null,"category":"security-tools","readme_excerpt":"Pulsar is a security tool for monitoring the activity of Linux devices at runtime, powered by eBPF. The Pulsar core modules use eBPF probes to collect events from the kernel in a safe and efficient way. Pulsar events can be categorized in the four main following areas: - Processes : processes information, including file execution and file opening. - File I/O : I/O operations on disk and memory. - Network : data from the network stack. Pulsar is built with a modular design that makes it easy to adapt the core architecture to new use cases, create new modules or write custom rules. Quickstart Warning A kernel 5.5 or higher with BPF and BTF enabled is required. Visit the official Pulsar website for the full requirements and installation options available. To download and install Pulsar, run the following in your terminal: Launch the pulsar daemon in a terminal with administrator privileges : That's pretty much it. At this point Pulsar is actively monitoring the activity of all the target processes, and checking it against the set of security policies defined in the rules file. You can test this by triggering a threat event, for example running the following command in another terminal: In the pulsar terminal you should see something similar to: As you can see Pulsar identifies the previous command as a threat event. How does it work? Behind the scenes, when an application performs an operation, it gets intercepted at kernel level by the Pulsar BPF probes, turned into a unique ev","default_branch":null,"files":null,"tree":[],"storefront":"/r/exein-io","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/exein-io/pulsar/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}