# aquasecurity/tracee

Linux Runtime Security and Forensics using eBPF

Repository: https://github.com/aquasecurity/tracee
Canonical: https://ross.abutalabs.com/products/tracee
Homepage: https://aquasecurity.github.io/tracee/latest
Language: Go
License: Apache-2.0
License Family: permissive
Topics: ebpf, linux, bpf, security, golang, docker, kubernetes, runtime-security
Last push: 2026-08-11T20:35:49+00:00

## Health v2 (maintenance only)
Score: 79/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 97, release rhythm 45, longevity 100
- inputs: {"age_days": 2541, "days_push": 22, "days_rel": 288, "gap_med": 33.0, "n_releases_24m": 11}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 4593, forks 507 (observed 2026-08-28T04:08:54.729169+00:00)

## What it is
Tracee is a Linux runtime security and forensics tool that uses eBPF to trace system calls, network activity, and file operations in real time. It exposes system activity as events and detects suspicious behavioral patterns for threat detection and observability.

## Use cases
- detect malware and privilege escalation on linux hosts
- monitor container and kubernetes runtime security
- trace syscalls and process execution for forensics
- debug application behavior and system issues
- monitor file access and data exfiltration for compliance
- get real-time security alerts from eBPF events

## When to choose
- you need eBPF-based runtime threat detection on Linux
- you run containers or Kubernetes and need container-aware security monitoring
- you want deep system observability without modifying application code

## When to avoid
- you need security monitoring on macOS or Windows
- your kernel or distribution lacks eBPF support
- you only need static vulnerability scanning rather than runtime analysis

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, monitoring, tracing, alerting
- domain: security, monitoring, operating-systems
- platform: go
- tags: ebpf, runtime-security, forensics, bpf, container-security, threat-detection, syscalls, containers, devops, linux, docker, kubernetes

## Member repositories
- aquasecurity/tracee (main) score 79

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:54.729169+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:19:49.631207+00:00, confidence not recorded.
  - readme: https://github.com/aquasecurity/tracee (fetched 2026-08-28T04:08:54.729169+00:00, sha b3001e4ec1be)
  - homepage: https://aquasecurity.github.io/tracee/latest (fetched 2026-08-29T09:04:56.005497+00:00, sha 03b1e2cdf4ab)
- Data as of 2026-08-30T08:39:29.467469+00:00.