Tetragon's file monitoring capabilities use eBPF for in-kernel filtering and policy enforcement, going beyond traditional monitoring features. By implementing hooks into in-kernel functions like security_file_permission, Tetragon can track file accesses and perform FIM effectively. In-kernel filtering minimizes overhead by deciding which events are of interest to the user, avoiding the generation of unnecessary events.