Bombini and Oburix: two small eBPF tools worth a lab evaluation

Two small open-source projects give MSPs a low-cost way to add kernel-level visibility to Linux fleets: Bombini, an eBPF-based monitoring agent written in Rust using the Aya library, and Oburix, a lighter eBPF-based endpoint detection tool with YAML-defined rules. Neither is a drop-in replacement for a commercial EDR, but both are worth a lab evaluation.

What each one does

Bombini attaches to Linux Security Module (LSM) hooks and turns kernel events — process execution, file operations, network connections, privilege-escalation attempts — into structured JSON output that a SIEM or log pipeline can consume. It's built entirely in Rust with no dependency on libbpf or bcc, and uses BTF/CO-RE for portability across kernel versions, though some LSM hooks need to be explicitly enabled at boot. Oburix takes a lighter approach: it watches process execution, network connections and filesystem activity, and matches that telemetry against detection rules written in YAML, aiming for a low-overhead footprint suited to SIEM or XDR integration.

How to evaluate them safely

• Pin and test kernel compatibility before any wider rollout — eBPF tooling is sensitive to kernel version and configuration.
• Run in a lab environment first, not against production hosts.
• Map each tool's detections to your existing SIEM or alerting pipeline rather than running it as a standalone console.
• Document a rollback path in case the agent itself causes performance or stability issues.

Both projects are small by GitHub standards — modest star and contributor counts compared to established tools like Falco or Tracee — which is worth factoring into any deployment decision: smaller projects mean faster iteration but also less battle-testing at scale. The practical takeaway is to treat either as a defensive telemetry source to pilot alongside existing tooling, not as a certified security product to switch on across a fleet.

Sources: GitHub — bombinisecurity/bombini, GitHub — Oburix.