GitHub - microsoft/ebpf-for-windows: eBPF implementation that runs on top of Windows

The following diagram shows the basic architecture of this project and related components: As shown in the diagram, in a typical developer workflow, the existing eBPF toolchains (clang, etc.) can be used to generate eBPF bytecode (stored in ELF format) from source code in various languages. There are three main approaches to process the eBPF bytecode and load it into Windows kernel. Native eBPF Pr

[matarillo]

CrowdStrikeインシデントで開発の優先度が上がるのかどうか。そもそもEDRをeBPF上に構築できるものか、その意味があるのかもよくわからんが。