I’m piloting eBPF-based telemetry (Tetragon) on two Kubernetes clusters while Zeek and Suricata watch the 10G east‑west transit, aiming to tie process lineage to flows for lateral movement detection. For those who’ve done this, how are you correlating workload identity (SPIFFE/SVID or service accounts) with IDS alerts without ballooning storage or relying on fragile SPAN/TAP chains?
We ended up pushing Tetragon proc/conn events into Kafka and enriching Suricata EVE on the fly with SPIFFE IDs via a Redis join keyed on “5‑tuple+proc_start”, TTL about 5–10 min — storage stays tiny and no SPAN/TAP. Caveat: clock skew ruins the join, so NTP is non‑negotiable; if you want fewer moving parts, pull the SVID with the SPIFFE Workload API (https://spiffe.io) in the enricher — think speed‑dating for flows. Does that fit your clusters’ data path?
I’ve had luck using specific labels in Kubernetes to track workload identity. Tying that to flow data from Suricata helps maintain context. Have you considered that approach?
I’ve found that using annotations in Kubernetes can help with tracing workload identity. It’s like putting a name tag on each pod — it makes correlating with IDS alerts a breeze without needing a massive storage overhaul. Have you thought about exploring that approach, @eriley99?