tracee

Tracee is a Runtime Security and forensics tool for Linux. It is using Linux eBPF technology to trace your system and applications at runtime, and analyze collected events to detect suspicious behavioral patterns. It is delivered as a Docker image that monitors the OS and detects suspicious behavior based on a pre-defined set of behavioral patterns.

Name

tracee

Main Program

tracee

Programs

• tracee

Homepage

• https://aquasecurity.github.io/tracee/latest/

Version

0.23.2

License

• Apache License 2.0
• GNU General Public License v2.0 or later

Maintainers

• Jack

Platforms

• x86_64-linux
• aarch64-linux

Defined

Source