The problem with eBPF is there are tons of old Linux servers without eBPF support. I had to go with auditbeat instead of Sysmon for Linux because of this. Not o

The problem with eBPF is there are tons of old Linux servers without eBPF support. I had to go with auditbeat instead of Sysmon for Linux because of this. Not only that, from the quick glance I gave their read me, I think auditbeat (which includes more than just the auditd subsys) collects more security relevant logs. The huge problem with all these solutions, including Sysmon for windows is they don't let you define throttling or not at a usefully granular level. Which means you either log and risk unexpected performance issues in some situations or lose visibility. Even with commerical EDRs, depending on kernel versions or other system properties is really bad and makes it hard to manage. It should "just work", lend itself to config/runtime external management. Of course, log storage is another nightmare but if you can easily tune configs and selectively drop or throttle at the edge you can save a lot of money.