{ "type": "excalidraw", "version": 2, "source": "https://excalidraw.com", "elements": [ { "id": "r1087585091", "type": "rectangle", "x": 20, "y": 58, "width": 300, "height": 214, "angle": 0, "strokeColor": "#dddddd", "backgroundColor": "#f4f4f4", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 3 }, "seed": 1448334231, "versionNonce": 1443673194, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false }, { "id": "t1329236510", "type": "text", "x": 32, "y": 64, "width": 79.2, "height": 15.0, "angle": 0, "strokeColor": "#888888", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 1186678219, "versionNonce": 330839071, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "kernel hooks", "fontSize": 12, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "kernel hooks", "lineHeight": 1.25, "baseline": 12 }, { "id": "r1223030723", "type": "rectangle", "x": 44, "y": 92, "width": 250, "height": 44, "angle": 0, "strokeColor": "#888888", "backgroundColor": "#f4f4f4", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 3 }, "seed": 1023853316, "versionNonce": 1412308199, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false }, { "id": "t780427271", "type": "text", "x": 54, "y": 100, "width": 154.0, "height": 17.5, "angle": 0, "strokeColor": "#111111", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 1505751114, "versionNonce": 1372893562, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "execve (new process)", "fontSize": 14, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "execve (new process)", "lineHeight": 1.25, "baseline": 14 }, { "id": "r1943467717", "type": "rectangle", "x": 44, "y": 150, "width": 250, "height": 44, "angle": 0, "strokeColor": "#888888", "backgroundColor": "#f4f4f4", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 3 }, "seed": 867834386, "versionNonce": 1760467595, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false }, { "id": "t1422144308", "type": "text", "x": 54, "y": 158, "width": 177.10000000000002, "height": 17.5, "angle": 0, "strokeColor": "#111111", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 1731724722, "versionNonce": 1616440711, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "ptrace (inject / debug)", "fontSize": 14, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "ptrace (inject / debug)", "lineHeight": 1.25, "baseline": 14 }, { "id": "r364637420", "type": "rectangle", "x": 44, "y": 208, "width": 250, "height": 44, "angle": 0, "strokeColor": "#888888", "backgroundColor": "#f4f4f4", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 3 }, "seed": 1634932404, "versionNonce": 1767638318, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false }, { "id": "t447024777", "type": "text", "x": 54, "y": 216, "width": 192.50000000000003, "height": 17.5, "angle": 0, "strokeColor": "#111111", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 439858376, "versionNonce": 1851065974, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "setuid (privilege change)", "fontSize": 14, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "setuid (privilege change)", "lineHeight": 1.25, "baseline": 14 }, { "id": "r271921122", "type": "rectangle", "x": 400, "y": 130, "width": 190, "height": 80, "angle": 0, "strokeColor": "#e8870c", "backgroundColor": "#fff8ef", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 3 }, "seed": 1355434586, "versionNonce": 356209989, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false }, { "id": "t1814530599", "type": "text", "x": 410, "y": 138, "width": 123.20000000000002, "height": 17.5, "angle": 0, "strokeColor": "#111111", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 75146479, "versionNonce": 1269013418, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "SecEvent RingBuf", "fontSize": 14, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "SecEvent RingBuf", "lineHeight": 1.25, "baseline": 14 }, { "id": "t1052872681", "type": "text", "x": 410, "y": 158, "width": 102.85000000000001, "height": 13.75, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 1804291226, "versionNonce": 1714543521, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "type \u00b7 pid \u00b7 comm", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "type \u00b7 pid \u00b7 comm", "lineHeight": 1.25, "baseline": 11 }, { "id": "r1835586594", "type": "rectangle", "x": 660, "y": 92, "width": 190, "height": 54, "angle": 0, "strokeColor": "#2f6db5", "backgroundColor": "#eef4fb", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 3 }, "seed": 48659418, "versionNonce": 984777994, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false }, { "id": "t198007049", "type": "text", "x": 670, "y": 100, "width": 53.900000000000006, "height": 17.5, "angle": 0, "strokeColor": "#111111", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 1829381547, "versionNonce": 1031958044, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "Grafana", "fontSize": 14, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "Grafana", "lineHeight": 1.25, "baseline": 14 }, { "id": "t1552673876", "type": "text", "x": 670, "y": 120, "width": 139.15, "height": 13.75, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 90512177, "versionNonce": 678445661, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "events by type/severity", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "events by type/severity", "lineHeight": 1.25, "baseline": 11 }, { "id": "r1228745226", "type": "rectangle", "x": 660, "y": 196, "width": 190, "height": 54, "angle": 0, "strokeColor": "#999999", "backgroundColor": "#ffffff", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "dashed", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 3 }, "seed": 1768525069, "versionNonce": 759707021, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false }, { "id": "t555637345", "type": "text", "x": 670, "y": 204, "width": 130.9, "height": 17.5, "angle": 0, "strokeColor": "#111111", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 953019241, "versionNonce": 515926562, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "shield (optional)", "fontSize": 14, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "shield (optional)", "lineHeight": 1.25, "baseline": 14 }, { "id": "t110535108", "type": "text", "x": 670, "y": 224, "width": 90.75000000000001, "height": 13.75, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 1620793847, "versionNonce": 1169581115, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "block via LSM \u2192", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "block via LSM \u2192", "lineHeight": 1.25, "baseline": 11 }, { "id": "a258230936", "type": "arrow", "x": 294, "y": 114, "width": 106, "height": 36, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 2 }, "seed": 1297863408, "versionNonce": 1706632983, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "points": [ [ 0, 0 ], [ 106, 36 ] ], "lastCommittedPoint": null, "startBinding": null, "endBinding": null, "startArrowhead": null, "endArrowhead": "arrow" }, { "id": "t974902964", "type": "text", "x": 347.0, "y": 118.0, "width": 40, "height": 13.75, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 529465601, "versionNonce": 1592282949, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "emit", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "emit", "lineHeight": 1.25, "baseline": 11 }, { "id": "a995702239", "type": "arrow", "x": 294, "y": 172, "width": 106, "height": 2, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 2 }, "seed": 1592340028, "versionNonce": 826021584, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "points": [ [ 0, 0 ], [ 106, -2 ] ], "lastCommittedPoint": null, "startBinding": null, "endBinding": null, "startArrowhead": null, "endArrowhead": "arrow" }, { "id": "a1978208117", "type": "arrow", "x": 294, "y": 230, "width": 106, "height": 40, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 2 }, "seed": 28779056, "versionNonce": 457760750, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "points": [ [ 0, 0 ], [ 106, -40 ] ], "lastCommittedPoint": null, "startBinding": null, "endBinding": null, "startArrowhead": null, "endArrowhead": "arrow" }, { "id": "t402680307", "type": "text", "x": 347.0, "y": 196.0, "width": 40, "height": 13.75, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 1223027399, "versionNonce": 667560783, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "emit", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "emit", "lineHeight": 1.25, "baseline": 11 }, { "id": "a1118024017", "type": "arrow", "x": 590, "y": 160, "width": 70, "height": 42, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 2 }, "seed": 669987742, "versionNonce": 1409326629, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "points": [ [ 0, 0 ], [ 70, -42 ] ], "lastCommittedPoint": null, "startBinding": null, "endBinding": null, "startArrowhead": null, "endArrowhead": "arrow" }, { "id": "t1084844835", "type": "text", "x": 625.0, "y": 125.0, "width": 54.45, "height": 13.75, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 260248527, "versionNonce": 674974333, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "telemetry", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "telemetry", "lineHeight": 1.25, "baseline": 11 }, { "id": "a1968235895", "type": "arrow", "x": 590, "y": 180, "width": 70, "height": 30, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "dashed", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 2 }, "seed": 150261966, "versionNonce": 265219838, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "points": [ [ 0, 0 ], [ 70, 30 ] ], "lastCommittedPoint": null, "startBinding": null, "endBinding": null, "startArrowhead": null, "endArrowhead": "arrow" }, { "id": "t1897802068", "type": "text", "x": 625.0, "y": 181.0, "width": 54.45, "height": 13.75, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 1881474396, "versionNonce": 1261076377, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "+ enforce", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "+ enforce", "lineHeight": 1.25, "baseline": 11 }, { "id": "t1016766696", "type": "text", "x": 600, "y": 30, "width": 314.6, "height": 13.75, "angle": 0, "strokeColor": "#b8650a", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 326747148, "versionNonce": 1135973617, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "the sensor layer of a runtime-security tool, in eBPF", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "the sensor layer of a runtime-security tool, in eBPF", "lineHeight": 1.25, "baseline": 11 }, { "id": "t765564061", "type": "text", "x": 440, "y": 294, "width": 484.00000000000006, "height": 13.75, "angle": 0, "strokeColor": "#888888", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 1178064179, "versionNonce": 691252047, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "observe many attacker-relevant operations as one stream \u2014 then optionally shield", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "observe many attacker-relevant operations as one stream \u2014 then optionally shield", "lineHeight": 1.25, "baseline": 11 } ], "appState": { "viewBackgroundColor": "#ffffff", "gridSize": null }, "files": {} }