## What is eBPF Kernel Tracing?
Extended Berkeley Packet Filter (eBPF) enables running sandboxed programs in the Linux kernel without changing kernel source code or loading kernel modules.
By hooking into system calls like `sys_enter_execve` and `sys_enter_connect`, Sentinel Shield analyzes application behavior in real-time.
Zero-Trust Model Isolation
When an AI model process attempts unauthorized socket connections or file system writes, eBPF probes immediately trigger automated process isolation in under **10 microseconds**.