Testing Pixie's Adaptive Write
How to write only what matters?
You have a Kubernetes cluster running for months. An attacker hits one pod for 90 seconds. What does your SOC see? Today, without anomaly-triggered capture, the answer is one of two : either nothing — because the action wasnt captured — or terabytes of constant telemetry. With the adaptive write feature in place, the answer changes: ±5 min of detailed network and stack_trace diagnostics around every anomaly, automatically, and the option to configure your own queries to capture additional bpf_traces or different time windows.
What is the trigger? The violation of whats “normal”
Whenever an SBOB (future post coming on how they are tuned) is either violated or a static IoC (Indicator of Compromise) Rule is firing, the capture is toggled ACTIVE. However, it captures the past, not just the future. Because we have a backwards window of 24hrs.
No single component sees the full picture in isolation — they’re chained by anomaly identity (a hash over <pid, comm, pod, namespace>).
As you can guess, having a good initial trigger point is important here and avoiding false positives is crucial
The operator centers a 10-minute capture on each Kubescape event: five minutes before (already retained in Pixie’s Edge Module), and five minutes after (unless otherwise specified by the User). Outside that window the cluster writes nothing.
From early architecture to Node-Local
By default, pixie edge modules (pem) communicate via the vizier-query-broker to ensure all queries are coordinated cluster-wide.
We introduced a new path for more extreme noise-levels: pem-direct.
PEM-direct
The goal of our architecture is to steer and filter the required evidence as quickly as possible, which is why we decided to implement a fully node-local mode, in which all daemons directly communicate, cache and reconstruct as much context as possible, until they reach out to other nodes (via the query-broker) for cluster-wide correlation.
This means, there is now a compile gated feature, in which pem can be authenticated against directly and the evidence required extracted directly.
This allows us to make decisions in real-time and allows data to stay fully local during the evaluation.
Funding & licence
This work was supported by the netidee programme of the Internet Foundation Austria. Antrag Nr. 7918, project SovereignSOC, Fördernehmer: SBA Research, Key Researcher: Dr. Constanze Roedig.
© 2026 Dr. Constanze Roedig. All rights reserved. No part of this post may be reproduced, redistributed or used to train derivative models without prior written permission. Code referenced from any linked repositories is licensed separately under Apache 2.0 and/or GPL v2 (see each repo for its declared licence).