My company just open-sourced a first-of-its-kind Sigma rules engine.

We started this project due to usability and security gaps in existing tools like Tetragon, KubeArmor, and Falco.
We to become the gold standard for prevention and detection on Linux systems.
While existing tools excel at observability, they struggle with prevention and enforcement. This is the gap we came to close.

Our main focus:
- Implementing Sigma rules features in the kernel
- Enriching events and rules with context important for defenders
- Features designed around needs of real security teams

Moment of Honesty
Tetragon, Falco, and KubeArmor are amazing solutions and I've been using them for years.
They are mature and healthy projects.
owLSM is still young and hungry. It already introduces many innovative capabilities but has a long way to go.

Go check out the project!
Any contribution, user feedback, or issue is appreciated.