tracee

by aquasecurity

4.0Kstars

453forks

56watchers

Updated 8 months ago

About

Tracee is a Linux runtime security and forensics tool that leverages eBPF to detect and analyze suspicious system behavior in real-time.

Linux Runtime Security and Forensics using eBPF

Primary Use Case

Tracee is primarily used by security professionals and system administrators to monitor Linux endpoints for malicious activity and perform forensic investigations. It provides deep visibility into system calls and kernel events to detect intrusions and anomalous behavior without impacting system performance.

Key Features

Real-time tracing of Linux kernel events using eBPF
Detection of suspicious behavior and intrusion attempts
Forensic analysis capabilities for post-incident investigations
Lightweight and efficient with minimal performance overhead
CLI-based tool for easy integration into security workflows
Support for custom detection rules and event filtering
Open-source with active community support

Installation

Ensure Linux kernel version supports eBPF (4.14+ recommended)
Install dependencies: clang, llvm, libelf-dev, gcc
Clone the repository: git clone https://github.com/aquasecurity/tracee.git
Navigate to the tracee directory: cd tracee
Build the tool using make: make
Run Tracee with appropriate permissions (usually as root)

Usage

>_ ./tracee-ebpf

Start Tracee to monitor kernel events in real-time with default settings

>_ ./tracee-ebpf --help

Display help information and available command line options

>_ ./tracee-ebpf --trace process

Trace only process-related events

>_ ./tracee-ebpf --output json

Output events in JSON format for easier parsing and integration

>_ ./tracee-ebpf --filter 'event=execve'

Filter events to show only execve system calls

Security Frameworks

Discovery

Defense Evasion

Collection

Credential Access

Execution

Usage Insights

Integrate Tracee with SIEM platforms for enriched alerting and correlation.
Leverage custom eBPF rules to tailor detection to specific threat models or environments.
Use Tracee in purple team exercises to validate detection capabilities against red team tactics.
Deploy Tracee in CI/CD pipelines to catch anomalous behavior during application runtime testing.
Combine Tracee outputs with automated response tools to enable faster incident containment.