01 — CausalGuard
Who did what. And why.
CausalGuard is a causal forensics engine for Linux, powered by eBPF. It records what every process does, folds it into a live causality graph, and hands you answers — not another event firehose.
OS-level blame
One command — cg blame — answers "who modified this
file, and why" with the full causal ancestry:
vim ← bash ← sshd, in under a second.
It feels like git blame, but for your whole machine.
A graph, not a firehose
eBPF probes fold high-frequency syscalls together inside the kernel, so seconds of raw events become hours of queryable history in megabytes of RAM — engineered to a system-wide CPU budget of under three percent.
CQL — query causality itself
A purpose-built query language for the graph:
MATCH (a)-[:CAUSED*]->(b). Trace a command's
execution tree, follow taint forward from a sensitive file, or ask
your own questions — with container-aware process identity that
PID recycling can't fool.
Honest by default
CausalGuard is open source and currently in prototype. We document what it can't see yet — mmap mutations, kernel-level evasion — as carefully as what it can. No marketing over the gap.
What is causal forensics?
Causal forensics connects security events into a directed graph of cause and effect. Instead of reading thousands of isolated alerts, analysts ask "who modified this file, and why" and receive the full execution ancestry.
How does CausalGuard use eBPF?
CausalGuard installs eBPF probes inside the Linux kernel to trace process creation, file access and network activity with minimal overhead. Events are compressed into a causality graph in user space.
Is CausalGuard open source?
Yes. CausalGuard is developed in the open under an OSI-approved license. Source code, design documents and known limitations are published alongside the project.
What Linux versions are supported?
CausalGuard targets modern Linux kernels with stable eBPF support and BTF availability. Specific minimum kernel versions and distribution packages are documented in the repository.