Tracee is a cloud-native runtime security and forensics tool that uses eBPF to capture system calls and kernel events in real time. It operates as a standalone binary or a Helm-deployable agent for Kubernetes, normalizing system calls, network events, and container activities into a unified event pipeline for consistent analysis.
The tool distinguishes itself through policy-driven event filtering using YAML-based rules, allowing users to target specific workloads and reduce noise during monitoring. It includes built-in threat detection signatures that flag suspicious behavioral patterns without requiring custom rules, and it collects forensic artifacts such as memory dumps, binaries, and network traffic for post-incident investigation.
Tracee provides comprehensive system observability by tracking over 400 system events, including process execution, file operations, and network activity. It generates real-time security alerts and supports incident investigation through detailed audit trails with process lineage and file paths. The tool is designed for monitoring containerized environments and Kubernetes clusters without requiring application modifications.