# Engineering a Zero-Trust Kubernetes SIEM: Bypassing NAT Blindness with eBPF, TC, and Suricata

**URL:** <https://forum.suricata.io/t/engineering-a-zero-trust-kubernetes-siem-bypassing-nat-blindness-with-ebpf-tc-and-suricata/6291>\
**Category:** Community Announcements\
**Tags:** suricata\
**Created:** [May 13, 2026, 1:27pm UTC](https://forum.suricata.io/t/engineering-a-zero-trust-kubernetes-siem-bypassing-nat-blindness-with-ebpf-tc-and-suricata/6291 "2026-05-13T13:27:41Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yeslem\_kh](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/yeslem_kh/32/3892_2.png) [@Yeslem\_kh](https://forum.suricata.io/u/Yeslem_kh)\
**Post date:** [May 13, 2026, 1:27pm UTC](https://forum.suricata.io/t/engineering-a-zero-trust-kubernetes-siem-bypassing-nat-blindness-with-ebpf-tc-and-suricata/6291/1 "2026-05-13T13:27:41Z")

</div>

Standard Kubernetes network security is fundamentally broken by NAT blindness. When an intrusion alert fires, traditional tools show a physical node IP, leaving you guessing which of the hundreds of ephemeral pods is actually compromised. I engineered a custom SIEM pipeline that uses eBPF and Linux Traffic Control to mirror virtual CNI traffic directly to Suricata. By binding this telemetry to a deterministic O(1) Logstash memory router, the system maps transient IPs to exact pod names and namespaces in under 5 milliseconds. This architecture completely eliminates the Kubernetes blind spot, providing true zero-trust visibility across both kernel execution and East-West lateral network movement.

Read the full technical architecture breakdown here: [[https://medium.com/@mouhamed.yeslem.kh/engineering-a-zero-trust-kubernetes-siem-bypassing-nat-blindness-with-ebpf-tc-and-suricata-767c70a55058\](https://medium.com/@mouhamed.yeslem.kh/engineering-a-zero-trust-kubernetes-siem-bypassing-nat-blindness-with-ebpf-tc-and-suricata-767c70a55058%5C)]([https://medium.com/@mouhamed.yeslem.kh/engineering-a-zero-trust-kubernetes-siem-bypassing-nat-blindness-with-ebpf-tc-and-suricata-767c70a55058](https://medium.com/@mouhamed.yeslem.kh/engineering-a-zero-trust-kubernetes-siem-bypassing-nat-blindness-with-ebpf-tc-and-suricata-767c70a55058))