kunai-project/kunaieBPF-based Linux security monitor and threat hunter providing chronologically ordered, container-aware events with on-host correlation for incident response and forensic analysis.
Kunai is a powerful tool designed to bring actionable insights for tasks such as security monitoring and threat hunting on Linux systems. Think of it as the Linux counterpart to Sysmon on Windows, tailored for comprehensive and precise event monitoring.
Kunai leverages eBPF (Extended Berkeley Packet Filter) technology, with kernel-level probes that capture critical events. These probes send data to a userland program, responsible for tasks like reordering, enriching, and correlating the collected events.
On the implementation side, Kunai is predominantly written in Rust, using the robust Aya library. This design ensures a self-contained standalone binary, embedding both the eBPF probes and the userland processing logic for ease of deployment.
Before proceeding, please note that a distribution-agnostic, pre-compiled version of Kunai is available on the release page. If you simply want to try Kunai, you likely don’t need to build the project yourself.
You can use a Docker image that includes everything needed to build the project easily: Kunai build docker image.
This one-size-fits-all solution should work on any Linux distribution.
Before being able to build everything, you need to install a couple of tools.
rustupclang, libbpf-dev and bpf-linkerExample of commands to install requirements on Ubuntu/Debian:
sudo apt update
sudo apt install -y clang libbpf-dev lld musl-tools
# assuming you have rustup and cargo installed
cargo install bpf-linker
Once you have the requirements installed, you are good to go.
cargo build
# find your executable in: ./target/debug/kunai
For production deployment, we recommend building a static binary using MUSL:
# Build static release binary
cargo build --release --target x86_64-unknown-linux-musl
# The static binary will be available at:
./target/x86_64-unknown-linux-musl/release/kunai
Why MUSL? MUSL produces static binaries that are more portable across different Linux distributions, avoiding dependency issues with glibc versions. This is particularly important for production deployment where you may not control the target environment.
To cross-compile kunai for aarch64:
Install the aarch64 musl target:
rustup target add aarch64-unknown-linux-musl
Install the cross-compilation toolchain (Ubuntu/Debian example):
sudo dpkg --add-architecture arm64
sudo apt update
sudo apt install -y git clang libbpf-dev lld musl-tools
sudo apt install -y crossbuild-essential-arm64 musl-tools:arm64
Build for aarch64:
cargo build --release --target aarch64-unknown-linux-musl
The cross-compiled binary will be available at:
./target/aarch64-unknown-linux-musl/release/kunai
If one believes Kunai has an issue with memory, here is a way to profile it.
# compile kunai with debug information for all packages
RUSTFLAGS="-g" cargo build
# use heaptrack
sudo heaptrack kunai
Sysmon For Linux: https://github.com/Sysinternals/SysmonForLinux
The NGSOTI project is dedicated to training the next generation of Security Operation Center (SOC) operators, focusing on the human aspect of cybersecurity. It underscores the significance of providing SOC operators with the necessary skills and open-source tools to address challenges such as detection engineering, incident response, and threat intelligence analysis. Involving key partners such as CIRCL, Restena, Tenzir, and the University of Luxembourg, the project aims to establish a real operational infrastructure for practical training. This initiative integrates academic curricula with industry insights, offering hands-on experience in cyber ranges.
NGSOTI is co-funded under Digital Europe Programme (DEP) via the ECCC (European cybersecurity competence network and competence centre).