Our optional sensor attributes activity to the originating identity when activity occurs inside of container technologies such as Docker, containerd, Kubernetes (K8s); on cloud-native services such as ECS, EKS, GKE; or on bare-metal nodes such as EC2 or GCE. The ClearVector sensor is available for both AMD64 and ARM64 and is supported on a variety of operating systems including Bottlerocket and Amazon Linux.

When the sensor is deployed, ClearVector adds runtime activity about how identities operate inside of your workloads to our identity models, and sends notifications when risky activity occurs.

Trace every interactively typed command back to its source - whether it originated from SSH, SSM, ECS exec, or other interactive environment.

Built with Rust and eBPF, memory safety and predictable resource usage is key. Every CPU cycle and MB of memory is optimized for production environments.

For most workloads, the sensor consumes <1% CPU, <50 MB of RAM, <50M on disk, and <5MB of network traffic during updates.

Deploy the sensor manually on your image, use our minimal Chainguard derived image, or deploy as an ECS daemon service.