How do you actually understand what an application is doing at runtime? In this talk, I’ll explore how to analyze applications from the outside by observing their behavior: what they call, how they interact with the system, and how they communicate with other services. Using a Kubernetes-based setup and eBPF, I’ll show how to capture these interactions in a way that helps with both understanding and investigation. The goal is to move beyond surface-level monitoring and build a clearer picture of how applications behave, so you can debug issues faster, spot anomalies, and respond more effectively when something goes wrong.