@growse @mjg59 Yes they use eBPF on Linux host.
I was pleasantly surprised to see their agent didn't taint the kernel on RHEL 8 and Debian Bookworm.