I am currently learning Tetragon on k8s. I understand how eBPF hooks (LSM, kprobe, and uprobe) work and how they provide highly granular and precise data about what a process is doing.

My simple question is: Why do we use this collected data to create a Service Security Profile?

In my opinion, we can easily identify every edge case of a process. I believe it is much easier to predict the behavior of a programmatically designed service (which is built to execute specific, predefined steps) compared to predicting unpredictable human behavior.

I have tried looking for an answer from online sources and AI tools, but I haven't found a satisfying explanation yet. Any insights would be appreciated!