Skip to content

eBPF passive AI discovery

eBPF passive capture is a last-resort discovery path for customers that have no CASB, DNS, firewall, or endpoint detection and response (EDR) telemetry to connect. When you have any of those, use CASB shadow-AI detection or DNS and firewall AI discovery, which also reads EDR logs, instead.

Onboarding scope

This guide covers the optional ebpf_passive_capture connector in the Venturi platform connector package. It is disabled by default, and no capture runs until the customer explicitly authorizes it.

Required safeguards

The connector enforces these safeguards:

Venturi capability Purpose
customer_authorized Confirms the customer authorized passive capture.
daemonset_optional Keeps deployment optional rather than required.
tcp_connection_metadata_only Restricts capture to TCP connection metadata.
tls_payload_parsing_forbidden Forbids parsing or storing any TLS record, including the handshake and application data.

These are Venturi capability identifiers for deployment controls, not Linux permissions. The optional DaemonSet uses the minimum kernel capabilities defined in the delivered manifest; review the Linux BPF documentation for the host facility.

What the collector sees

The collector identifies an AI provider only by matching each connection’s destination IP address against the provider IP ranges you configure. It does not read the TLS ClientHello or Server Name Indication (SNI), does not correlate DNS queries, and never parses TLS application data, so tls_payload_parsing_forbidden holds for the whole TLS stream. Each observation contains only:

  • destination IP address and port;
  • source IP address and the capturing device’s hostname;
  • observation time and byte count;
  • the provider label from the matching IP range.

Setup

  1. Confirm the legal and security approval for passive metadata collection.
  2. Configure provider IP ranges in VENTURI_EBPF_PROVIDER_IP_RANGES.
  3. Set VENTURI_EBPF_CAPTURE_CUSTOMER_AUTHORIZED=true only after approval is recorded.
  4. Set VENTURI_EBPF_CAPTURE_ENABLED=true only for the approved environment.
  5. The default lookback is 15 minutes; set VENTURI_EBPF_CAPTURE_LOOKBACK_MINUTES in the delivered deployment configuration to change it. See sync windows and failure behavior.
  6. In Venturi, go to Integrations / eBPF passive AI discovery and run Test connection.

Verification

  • The connector stays disabled until both the enabled and customer-authorized flags are set.
  • Observations contain only the fields listed above, and tls_payload_captured is false on every row.
  • Observations carry a low-confidence discovery label, not chargeback-ready attribution.
  • The deployment inventory confirms the collector has only the kernel and Kubernetes permissions declared in the delivered manifest.

Rotation and offboarding

Review the capture authorization on every renewal cycle. To offboard, disable the connector and remove the optional capture deployment from the approved environment.

Give feedback on this page

Sign in to send feedback. Opens in a new tab.

Copy page details 
Docs feedback: eBPF passive AI discovery
Page: https://docs.venturi.systems/connectors/ebpf-passive-capture/