Yeah I thought that was one of the primary use cases of eBPF. Not an expert though, just read about some of these things.