APP-LEVEL EBPF APPLICATIONS - USER VS. KERNEL PROBES

Summary from the TLDR InfoSec newsletter

Leveraging eBPF technology allows for the detailed monitoring of application performance and behavior in real-time without heavy instrumentation. This post describes two main methods, user and kernel probes, that offer different levels of visibility with varying impacts on application performance. Kernel probes provide efficient insights into applications without the performance overhead typically associated with user probes.