Skip to content

eBPF passive AI discovery

eBPF passive capture is a last-resort discovery path for customers that do not have EDR, CASB, DNS, or firewall telemetry available.

Release state

This guide documents the optional ebpf_passive_capture connector contract. It is disabled by default and requires explicit customer authorization before any capture is enabled.

Required authorization

The connector requires these safeguards:

Venturi capability Purpose
customer_authorized Confirms the customer authorized passive capture.
daemonset_optional Keeps deployment optional rather than required.
tcp_connection_metadata_only Restricts capture to connection metadata.
tls_payload_parsing_forbidden Confirms TLS application-data payload parsing and storage are forbidden.

These are Venturi deployment controls, not Linux permissions. The optional DaemonSet uses the minimum kernel capabilities defined in the delivered manifest; review the Linux BPF documentation for the host facility. Host is derived from ClientHello SNI when visible, then DNS correlation; TLS application data is never parsed. EDR is only an alternative discovery source, not a dependency of this connector.

Setup

  1. Confirm the legal and security approval for passive metadata collection.
  2. Configure provider IP ranges in VENTURI_EBPF_PROVIDER_IP_RANGES.
  3. Set VENTURI_EBPF_CAPTURE_CUSTOMER_AUTHORIZED=true only after approval is recorded.
  4. Set VENTURI_EBPF_CAPTURE_ENABLED=true only for the approved environment.
  5. The default observation lookback is 15 minutes; change it only in the delivered deployment configuration.
  6. In Venturi, open Integrations and select eBPF passive capture and run Test connection.

Verification

  • The connector is disabled until both enabled and customer-authorized flags are set.
  • Output contains TCP connection metadata only: destination IP, port, host, and timing fields.
  • TLS payload fields are absent and tls_payload_captured is false.
  • Observations carry a low-confidence discovery label, not chargeback-ready attribution.
  • The deployment inventory confirms the collector has only the kernel and Kubernetes permissions declared in the delivered manifest.

Rotation and offboarding

Review authorization on every renewal cycle. To offboard, disable the connector and remove the optional capture deployment from the approved environment.