I am building a little tool using eBPF and Rust (for being fast and safe) to tackle task of collecting evidence for SOC 2 audits.

Anyone else out there feel like gathering all that audit data is a massive time sink? Would a tool that could automate a lot of it at the kernel level be something you'd actually use?

What are the biggest data collection headaches you've run into with SOC 2? Any thoughts on whether eBPF could be a good fit for this?

Just curious if this resonates with anyone else before diving too deep. Cheers for any insights!

Is this kind of tool useful for anyone?