{"id":27064929,"url":"https://github.com/assaf-r/bervie","last_synced_at":"2026-01-19T18:01:28.878Z","repository":{"id":284122082,"uuid":"953888276","full_name":"Assaf-R/bervie","owner":"Assaf-R","description":"An eBpf security program that blocks the execution of files that were flagged as malicious by the give YARA detection rules. Named in convention with the other Scottish loch tools","archived":false,"fork":false,"pushed_at":"2025-03-27T14:21:08.000Z","size":7,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-05T17:20:19.007Z","etag":null,"topics":["ebpf","linux","python","security","yara"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Assaf-R.png","metadata":{"files":{"readme":"Readme.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-03-24T08:38:51.000Z","updated_at":"2025-03-27T14:21:12.000Z","dependencies_parsed_at":"2025-03-24T09:40:33.990Z","dependency_job_id":"6b1fff48-b4ae-471f-9701-663123bef736","html_url":"https://github.com/Assaf-R/bervie","commit_stats":null,"previous_names":["assaf-r/bervie"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Assaf-R/bervie","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Assaf-R%2Fbervie","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Assaf-R%2Fbervie/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Assaf-R%2Fbervie/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Assaf-R%2Fbervie/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Assaf-R","download_url":"https://codeload.github.com/Assaf-R/bervie/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Assaf-R%2Fbervie/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28578952,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-19T17:42:58.221Z","status":"ssl_error","status_checked_at":"2026-01-19T17:40:54.158Z","response_time":67,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ebpf","linux","python","security","yara"],"created_at":"2025-04-05T17:19:47.831Z","updated_at":"2026-01-19T18:01:28.845Z","avatar_url":"https://github.com/Assaf-R.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"### Bervie\nAn eBpf security program that blocks the execution of files that were flagged as malicious by the give YARA detection rules. Named in convention with the other Scottish loch tools \n\n### How does this work?\nThe python program - **bervie.py** - loads the bpf c program - **bervie_bpf.c** - and hooks the execve syscall with a kprobe.\nThe eBpf program checks if the file that is set to be executed checks any YARA detections from the given .yara file and if so blocks the execution.\nThe results are logged to /var/log/loch/bervieX.log\n\n### How to run\n***RUN AS ROOT*** \n\n$ pip install yara-python","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fassaf-r%2Fbervie","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fassaf-r%2Fbervie","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fassaf-r%2Fbervie/lists"}