Yes — Sysdig/csysdig are great tools and I’ve used them before. They’re excellent for syscall-level visibility and host/container forensics.

Cerberus targets a different layer: always-on, low-overhead network classification in CNI environments. It attaches at TC, limits L7 inspection intentionally, and focuses on predictable performance rather than rich event streams.

They’re complementary rather than competing tools.