apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: audit-network-connections
  annotations:
    security-tier: audit-baseline
    description: "Logs outound TCP connections at the kernel level."
spec:
  kprobes:
  - call: "tcp_connect"
    syscall: false
    args:
    - index: 0
      type: "sock"
    selectors:
    - matchArgs:
      - index: 0
        operator: "NotDAddr"
        values:
        - "127.0.0.1"
        - "::1"