Translate Linux internals into actionable detection engineering knowledge.
npx skills add https://github.com/OpenTideHQ/AgentTide --skill linux-internals
Please help me install this Agent Skill. Skill: linux-internals Source: https://github.com/OpenTideHQ/AgentTide/tree/main/skills/linux-internals Command: npx skills add https://github.com/OpenTideHQ/AgentTide --skill linux-internals
Linux knowledge is often hard to obtain and apply to detection engineering; this Skill consolidates Linux internals needed to write robust detections for Linux endpoints, servers, and containers.
Investigate a suspicious fork/exec sequence by tracing it through /proc, auditd records, and container namespaces to determine the correct detection signals.
High-intent search queries and answers about installing and using this skill.
To write precise Linux detections, trace suspicious fork/exec sequences through /proc, auditd records, and container namespaces to determine the correct telemetry signals. This approach differentiates legitimate admin tasks from abuse in containerized workloads.
Linux telemetry sources you can map to detection signals include auditd, eBPF tools, systemd, PAM, and SSH. Mapping these operations translates Linux internals into actionable knowledge for robust endpoint and server monitoring.
Yes, this approach works for containerized workloads by examining container namespaces and boundaries. It helps create detectors that differentiate legitimate Linux admin tasks from abuse within isolated container environments.
Investigate a suspicious fork/exec sequence by tracing it through /proc and auditd records alongside container namespaces. This determines the correct detection signals by mapping process lifecycles to actionable telemetry.
You need knowledge of process lifecycles, procfs, namespaces, capabilities, audit records, and container isolation. Understanding these Linux internals ensures robust telemetry mappings for effective detection engineering.
Use eBPF tools and auditd based on your telemetry requirements; both map Linux operations to actionable signals. eBPF offers dynamic kernel tracing while auditd provides systematic event logging for detection engineering.
pluginagentmarketplaceAutomate Linux shell scripting tasks with Bash, cron, and systemd timers.
yknothingDefine telemetry signals, dashboards, and alert rules for production systems.
stevessrMonitor process behavior via eBPF-based collection of file, network, and subprocess activity.
balsm-healthDetect container escape attempts via eBPF syscall monitoring and audit logging.
