A technical walkthrough of the eBPF agent, event pipeline, detection engine, and SaaS control plane that powers RuntimeGuard's real-time ransomware detection.
Kernel tracepoints
on Linux 5.8+
HTTPS transport
with API key auth
Sliding-window
behavioural rules
Timeline, process
tree, file list
Webhook or Slack
notification
A single eBPF program loaded as a userspace process. Hooks into kernel tracepoints using CO-RE (Compile Once, Run Everywhere) — no kernel module required, no recompilation for each kernel version. Works on any Linux 5.8+ host with BTF support, whether Ubuntu, RHEL, Debian, or a cloud-provided image. Runtime overhead is 0.3% CPU and 11 MB RSS — measured on a live production host.
The Go userspace agent reads from the eBPF ring buffer, enriches events with host metadata, and batches them into compressed HTTPS payloads. Events are delivered to the cloud API endpoint within seconds. The agent is a single statically-linked binary — no dependencies, no package manager required.
The RuntimeGuard SaaS control plane receives events, runs the detection engine, stores incidents, and serves the management dashboard. Built on Go (backend), PostgreSQL (tenants, incidents), and ClickHouse (event time-series). Multi-tenant with full data isolation between customers and environments.
Every execve syscall is captured. Process name, full command, parent PID, and UID are recorded. Short-lived processes — common in ransomware chains — are never missed.
File writes are observed via openat with O_WRONLY/O_RDWR flags. The path and writing process are correlated so write bursts can be attributed to a specific PID.
Both rename and renameat2 syscalls are captured. Ransomware commonly renames files to add an extension (e.g. .locked) as part of the encryption process.
▸ amber border = active 60-second window · green = event observed · red = threshold exceeded → incident created
| Rule | Trigger | Window | Threshold | Severity | Score |
|---|---|---|---|---|---|
| file_write_burst | file_write events | 60 s | ≥ 10 | medium | 65 |
| file_rename_burst | file_rename events | 60 s | ≥ 5 | high | 80 |
| process_exec_burst | process_exec events | 60 s | ≥ 15 | high | 75 |
Read the full documentation or start a free 14-day trial and explore the architecture hands-on.