The Capsule8 sensor collects many different data types by default.
- Container lifecycle
- File opens
- Kernel function calls
- Network activity
- Process lifecycle
- Raw system calls
The sensor collects host telemetry through a kprobe event monitor. We use perf, an instrumentation tool within the Linux kernel, to extract kprobe events. The sensor includes a telemetry service via a grpc server to receive telemetry events.
Leveraging this telemetry, the Capsule8 sensor adds detection, integration, and investigation capabilities.
|Analytics||A detection engine that analyzes collected events.|
|Integrations||Integrations allow alerts and metaevents to be exported into third party systems.|
|Metaevents||A “flight recorder” that stores facts about the host for use in investigation.|