Monitor connections to IPs

[MarwanNour]

Just wondering if it's possible to monitor incoming/outgoing connections to certain IPs. I've seen the tcp_connect example and I'm trying to figure out how I can look for IP addresses and trigger events based on that.
A scenario would be having a process trying to connect to a C2 server (or several) and the goal is to trigger a Sigkill action after I detect that connection.

[MarwanNour]

Solution in: https://github.com/cilium/tetragon/blob/main/docs/security-observability-with-ebpf/04_chapter/01_cilium_tracing_policy/03_etc_kubernetes_manifests_write.yaml