Skip to content

Commit bf49a1a

Browse files
committed
Update linux-support-ebpf.md
1 parent bde6b0e commit bf49a1a

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

defender-endpoint/linux-support-ebpf.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -210,13 +210,13 @@ If you prefer to continue using AuditD:
210210

211211
- Long-Term Plan: While staying on the `101.24072.0000` build is an option, we recommend planning your transition to eBPF within this timeframe to ensure you benefit from the latest security and performance improvements and also get continued support.
212212

213-
That said, our recommendation would be to plan a move to leveraging eBPF as the primary event provider.
213+
That said, our recommendation would be to plan a move to using eBPF as the primary event provider.
214214

215215
**3. What Happens If eBPF Is Not Supported in Some Scenarios?**
216216

217-
In cases where eBPF is not supported:
217+
In cases where eBPF isn't supported:
218218

219-
- Netlink Fallback: The system will fall back to using the Netlink event provider. While Netlink will continue to capture process events (e.g., exec, exit, fork, gid, tid), it does not support file system-related events (e.g., rename, unlink) or socket events.
219+
- Netlink Fallback: The system falls back to using the Netlink event provider. While Netlink continues to capture process events (e.g., exec, exit, fork, gid, tid), it does not support file system-related events (e.g., rename, unlink) or socket events.
220220

221221
- Impact: Your workloads will not be disrupted, but you may miss out on specific file and socket-related events that eBPF would otherwise capture.
222222

0 commit comments

Comments
 (0)