eBPF · Rust · Linux 5.8+ · Level 4/20 Enterprise

Talus
Process Monitor

Real-time kernel-level process, file-operation, and network telemetry for Linux. Zero overhead. Zero agents. Just eBPF.

View on GitHub 📄 Enterprise Report (PDF) Install from crates.io →
talus — live kernel tracing
[14:32:01.003] exec bash pid=12847 uid=1000 cmd="make -j8" [14:32:01.004] open /src/main.rs pid=12847 flags=O_RDONLY [14:32:01.005] open /build/output.o pid=12852 flags=O_WRONLY|O_CREAT [14:32:01.008] open /lib/libc.so pid=12847 flags=O_RDONLY|O_CLOEXEC [14:32:02.001] conn 10.0.0.5:443 pid=12901 proto=TCP bytes=2847 [14:32:02.003] send 10.0.0.5:443 pid=12901 bytes=1024 seq=1 [14:32:03.100] ⚠ ALERT RANSOMWARE SCORE: 87/100 proc=unknown-worker files=142 in 3s

Built for the kernel

eBPF tracepoints. Per-CPU perf buffers. Ratatui TUI. Zero-copy from kernel to screen.

🔬

Kernel-Level Tracing

Traces execve, openat, connect, accept, sendto, recvfrom at the kernel level using eBPF tracepoints. Verifier-safe with bpf_probe_read_user.

📊

7-Panel TUI Dashboard

Live terminal interface with Events, Processes, Network, TopFiles, Extensions, Alerts, and Ransomware Heatmap. Built with Ratatui.

🛡️

Ransomware Detection

Continuously scores per-process file-open rates against a sliding window. Flags ransomware-style mass file access in real-time with configurable thresholds.

⚡

Zero-Copy Pipeline

Fixed-size ProcessEvent structs through per-CPU PerfEventArray. No heap allocations in the hot path. Kernel to userspace in nanoseconds.

🌐

Network Tracing

Captures TCP/UDP connections, byte counts, and remote endpoints — all from kernel-level tracepoints. No packet sniffing needed.

🐳

Docker & Kubernetes

Runs in containers with --privileged. Includes K8s DaemonSet, ServiceMonitor for Prometheus, and GHCR images.

~0%
CPU overhead (idle)
<1μs
Event latency
36
Tests passing
4/20
Enterprise level

Architecture

From kernel tracepoint to your terminal — zero copies, zero locks, zero overhead.

Kernel Space
eBPF Programs
→
Ring Buffer
PerfEventArray
→
Userspace
Rust + aya
→
Display
Ratatui TUI

Start in 30 seconds

One command. Full kernel observability.

# Install from crates.io $ cargo install process-monitor # Or clone and build $ git clone https://github.com/BartoszOsiej/talus-process-monitor # Run (requires root for eBPF) $ sudo ./target/release/process-monitor 🔬 Talus Process Monitor v0.1.0 eBPF programs loaded. Tracing syscalls... # Docker $ docker run --privileged -it ghcr.io/bartoszosiej/talus:latest

Enterprise Ready

Level 4 of 20 towards full enterprise maturity. Supply chain security, build provenance, code hardening, and quality gates — all automated.

🔗

Supply Chain Security

cargo-deny license & advisory gates, CycloneDX SBOM, gitleaks secret scanning, dependency review on every PR.

🔐

Build Provenance

SLSA Level 2 provenance, Sigstore cosign keyless signing, GitHub artifact attestation, SHA-256/512 checksums.

🛡️

Security Hardening

SAFETY docs on all unsafe blocks, SecurityHeadersLayer (CSP, DENY, nosniff), crate-level lints enforced.

🧪

Quality Gates

36 unit tests (+177%), edge cases, monitor invariants, clippy clean with -D warnings.

📄 Download Full Enterprise Report (PDF)