>_SecOpsLog_
All courses

Runtime & eBPF security

Advanced5 sections · 15 lessons · ~9h total · 60-question self-test
Start course
01

eBPF & kernel foundations

3 lessonsTest yourself
01eBPF for runtime securitySandboxed kernel programs, maps, and the verifier.35 min02LSM & mandatory access controlWhere SELinux/AppArmor and BPF-LSM hook in.30 min03Kernel events & enrichmentThe syscalls that matter, plus container context.30 min
02

Kernel hardening & isolation

3 lessonsTest yourself
01seccomp syscall filteringRuntimeDefault and custom default-deny profiles.30 min02AppArmor & SELinuxPath-based and label-based container confinement.35 min03Capabilities, namespaces & cgroupsDrop ALL, non-root, and the isolation primitives.30 min
03

Falco & runtime detection

3 lessonsTest yourself
01Falco runtime detectionDriver, engine, rules; shells in containers.35 min02Tuning Falco for signalScoped exceptions, custom rules, low noise.30 min03Routing & automated responseFalcosidekick, Talon, isolate on critical.30 min
04

Enforcement: Tetragon & Cilium

3 lessonsTest yourself
01Tetragon in-kernel enforcementTracingPolicy and synchronous Sigkill.35 min02Cilium network policy & HubbleIdentity-based L3–L7, default-deny, encryption.35 min03Detect vs enforce, safelyThe spectrum and a waved rollout.30 min
05

Container escapes & IR

3 lessonsTest yourself
01Container escape pathsPrivileged, hostPath, sockets, caps, runtime CVEs.35 min02Detecting escapes at runtimeThe behavioral signatures and fast containment.30 min03Runtime incident responseIsolate, preserve, hunt persistence, recover.35 min
Final exam
Test yourself on everything
60 questions drawn from all 5 sections — every answer explained as you pick.
Start final exam