I think most are in-kernel these days so would be able to monitor things like bpf