adriyansyah-mf/OWO

eBPF endpoint observer for Linux: exec, file & network events as JSONL for your SIEM

Go19 stars9 forks

What it does

Open Workstation Observer (OWO) is a lightweight eBPF-based monitoring tool for Linux that tracks exec, file, and network events, outputting them as JSON for SIEM integration. This enhances visibility and security for Linux systems by providing detailed event logging.

Star history

Not enough history yet — 1 day(s) recorded. The daily snapshot builds this up.

Tracking

Last trending: 2026-02-21

Creator kit

Hook

Discover how OWO leverages eBPF for enhanced Linux endpoint visibility and security!

Content angles

Create a tutorial on setting up OWO for Linux endpoint monitoring.
Discuss the benefits of using eBPF for security and monitoring in Linux environments.
Share case studies or examples of how OWO can improve incident response in SIEM systems.

Who should care

Linux system administrators and cybersecurity professionals looking for advanced monitoring solutions.