Just a few weeks after Cisco formally closed its acquisition of Isovalent, the company is out today with a new release of the Tetragon security technology.

Isovalent is the leading vendor behind the open source Cilium and Tetragon technologies, both of which are based on eBPF (extended Berkeley Packet Filter), which is a Linux kernel technology that can be used for networking observability and security.

The new Tetragon open source 1.1 and Isovalent Enterprise for Tetragon 1.13 updates bring significant advancements in runtime security for Kubernetes environments. (Editors note: according to Isovalent, Isovalent Enterprise for Tetragon is in sync with the OSS version, but tagged as version 1.13). A key highlight is the introduction of Kubernetes Identity Aware Policies, enabling granular policy application to specific pods or namespaces.

While Isovalent is now a Cisco company, not much has changed for Isovalent's technical direction for Tetragon

“Nothing has changed to our roadmap since the acquisition, and the candid expectation is that nothing will change moving ahead for the short and long term,” Jeremy Colvin, senior security engineer at Isovalent told SDxCentral. “The core principles of Tetragon remain, to create an open-source eBPF security tool that offers extremely deep observability at low overhead, with the Kubernetes awareness that cloud native workloads demand to make it easy for teams to deploy and get value.”

Tetragon is a run-time security and observability enforcement tool. At a high level, it's an agent, written in the Go language  that can run on any Linux machine and it uses eBPF for observability. By sitting in the kernel with eBPF, it can observe granular security events - everything from process execution, to system calls, to high volume I/O activity including network and file access.

Prior versions of Tetragon applied security policies cluster-wide across Kubernetes workloads. With Identity Aware Policies, users can now tailor policies for discrete subsets of workloads, specifying stricter enforcement or exceptions with greater granularity. This improved identity awareness also reduces unnecessary security events, minimizing alert noise and overhead. Colvin noted that the updated Kubernetes awareness now allows for policy application at a pod or namespace level which improves flexibility in how teams build and implement policies to protect or audit workloads.

The update also promotes Tetragon's Default Ruleset  enterprise users, providing teams with quick, out-of-the-box monitoring for core security use cases like runtime executions, network observability, file integrity monitoring, operating system integrity, container sandboxing, and security-sensitive events. Enterprise users will now also benefit from Sandbox Policies to improve system call monitoring. Sandbox Policies provide a simplified and high-level approach to auditing and enforcing system calls. Instead of writing policies for each workload's system calls, these policies use a list of system calls as a denylist or allowlist for applications.

“Tetragon Enterprise is the hardened, supported version of open source Tetragon,” Colvin said.

He explained that while the core of the open source and enterprise are the same, there are notable improvements around how enterprise handles parsing network traffic, dashboards and now the default rulesets.

Looking forward Colvin said that there is lots on the roadmap coming for both the open source and enterprise versions.

“We are seeing the stability of Tetragon becoming increasingly recognized,” he said. “The core pieces of Tetragon continue growing from beta to limited to stable, with teams using Tetragon in production or even to build their own projects. ”