pipeline: inputs: add AegisBPF input plugin

SUMMARY.md

@@ -77,6 +77,7 @@
 ## Data pipeline
 
 * [Inputs](pipeline/inputs.md)
+  * [AegisBPF](pipeline/inputs/aegisbpf.md)
   * [Blob](pipeline/inputs/blob.md)
   * [Collectd](pipeline/inputs/collectd.md)
   * [CPU metrics](pipeline/inputs/cpu-metrics.md)

pipeline/inputs/aegisbpf.md

@@ -0,0 +1,62 @@
+# AegisBPF
+
+{% hint style="info" %}
+**Supported event types:** `logs`
+{% endhint %}
+
+The _AegisBPF_ input plugin streams runtime-security events from a co-located
+[AegisBPF](https://github.com/ErenAri/Aegis-BPF) agent into the Fluent Bit
+pipeline. AegisBPF is a BPF-LSM enforcement agent that exposes an opt-in,
+root-only Unix control socket; the plugin connects to it, requests the event
+stream, and forwards each newline-delimited JSON (OCSF) security event as a
+record. It reconnects automatically if the agent restarts.
+
+## Configuration parameters
+
+The plugin supports the following configuration parameters:
+
+| Key             | Description                                                                 | Default                            |
+|-----------------|-----------------------------------------------------------------------------|------------------------------------|
+| `socket_path`   | Path to the AegisBPF control socket (a root-only Unix stream socket).       | `/var/run/aegisbpf/aegisbpf.sock`  |
+| `reconnect_sec` | Interval in seconds between reconnection attempts while disconnected.       | `2`                                |
+
+## Prerequisites
+
+- The AegisBPF agent must run with its control socket enabled, for example
+  `AEGIS_API_SOCKET=/var/run/aegisbpf/aegisbpf.sock`.
+- The socket is created with `0600` permissions and owned by the agent (root),
+  so Fluent Bit must run as the same user (typically root) to connect.
+
+## Get started
+
+### Command line
+
+```shell
+fluent-bit -i aegisbpf -p socket_path=/var/run/aegisbpf/aegisbpf.sock -o stdout
+```
+
+### Configuration file
+
+```yaml
+pipeline:
+  inputs:
+    - name: aegisbpf
+      socket_path: /var/run/aegisbpf/aegisbpf.sock
+  outputs:
+    - name: stdout
+      match: '*'
+```
+
+```ini
+[INPUT]
+    name         aegisbpf
+    socket_path  /var/run/aegisbpf/aegisbpf.sock
+
+[OUTPUT]
+    name         stdout
+    match        *
+```
+
+Each security event is emitted as a single record whose body is the JSON object
+sent by the agent (AegisBPF emits OCSF-formatted events by default). The record
+timestamp is the time the event was received.