Tracee

Tracee is a Linux runtime security and observability tool that uses eBPF to capture system calls and generate security events. It ships with behavioral signatures for suspicious process, file, and network activity. Teams use it to detect anomalous behavior in containers and on hosts without changes to the monitored applications.

Runtime threat detection on Linux containers, Kubernetes pods, and hosts.

• +Built-in events cover more than 400 system calls plus network, security, and container activity.
• +Container-aware events and detection signatures.
• +Supports custom YAML policies and custom events written in Go.

• +Limited to Linux with recent kernel and eBPF support.
• +The documented Docker deployment runs as a privileged container in the host PID namespace.
• +Requires kernel BTF type information; some older distribution kernels are supported only through BTFHub.

Detect and investigate suspicious runtime behavior in cloud-native workloads before it escalates.