hi @mtremsal — I don't know the answers off-hand, but @alessandrogario has been working on this problem using eBPF

Thanks! I'll read a bit through the #ebpf channel. I had no idea osquery even had eBPF support for FIM.

the support Alessandro is working on in an extension for our extensions repo is not the same as the support in upstream

Hey @mtremsal! We are using kprobes to map processes inside containers. Basic fd tracking for socket_events is being implemented, and will be useful for implementing FIM too

Hi Alessandro. I work at Datadog. Since we already have an agent that handles live process and container monitoring, I'm looking more specifically at FIM at moment. I'll keep an eye on your PRs; really interesting stuff. 👍

Thanks! We'll make sure to post updates about it here on Slack! 🙂