I've not used it in anger, so take it with a grain of salt.

it sorta gives you a kernel space VM. you can inspect the state of things, make decisions about that state, and react to those things.

for example, you could look at uri requests coming into your web server. if it's not a known good path, reply back with a canned 400 - without ever hitting the web server. you can do this in the kernel.

_edit_ I think this particular trick would only work with http. the web server still has all the glue to decrypt the incoming request - but you could probably hook into ebpf at that point.