[zokier]

Does sysdig (and stratoshark by extension) still require custom out-of-tree kernel module to function?

[uhei]

No, with the parameter '--modern-bpf' you can use eBPF. So, no kmod required any more.