You’ve seen the talk – Detection And Blocking With BPF Via YAML – and now you want to get hands on! This workshop will take you from curious to competent in configuring the open source Tetragon to hook kernel functions by only writing straight forward YAML. Follow along on your own VM as we explore numerous demonstrations of detecting and blocking kernel actions depending on function arguments. Report events, kill processes, and trigger canaries, through fine-grained and entirely configurable, kernel observability. Bring a recent Ubuntu VM to get going quickly and easily.