aquasecurity/tracee

Health v2 · maintenance only

Adoption not part of the score

4593 stars · 507 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Tracee is a Linux runtime security and forensics tool that uses eBPF to trace system calls, network activity, and file operations in real time. It exposes system activity as events and detects suspicious behavioral patterns for threat detection and observability.

Use cases

• detect malware and privilege escalation on linux hosts
• monitor container and kubernetes runtime security
• trace syscalls and process execution for forensics
• debug application behavior and system issues
• monitor file access and data exfiltration for compliance
• get real-time security alerts from eBPF events

When to choose

• you need eBPF-based runtime threat detection on Linux
• you run containers or Kubernetes and need container-aware security monitoring
• you want deep system observability without modifying application code

When to avoid

• you need security monitoring on macOS or Windows
• your kernel or distribution lacks eBPF support
• you only need static vulnerability scanning rather than runtime analysis

Facets

cli-tool · maturity active

security monitoring tracing alerting security monitoring operating-systems go ebpf runtime-security forensics bpf container-security threat-detection syscalls containers devops linux docker kubernetes

Member repositories

For agents

markdown · JSON · MCP: product_card(name="aquasecurity/tracee")