Linux Telemetry Collection Design

Objective

Design the Linux telemetry surface required to model host behavior without collecting every kernel event.

Why this matters

The endpoint agent can only learn behavior that is represented in the collection contract, so telemetry coverage and collection cost must be designed together.

Design considerations

• Behavior-plane coverage.
• Broad modifications with narrow high-volume reads.
• Lossless collection, source-side redaction, and process-lineage correctness.

Key decisions

• Tetragon selected for the kernel behavioral stream.
• Semantic auth/DNS context separated from the kernel event stream.