tracee

package module
v0.16.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jun 29, 2023 License: Apache-2.0 Imports: 1 Imported by: 1

README

Tracee Logo

GitHub release (latest by date) License docker

Tracee: Runtime Security and Forensics using eBPF

Tracee uses eBPF technology to tap into your system and give you access to hundreds of events that help you understand how your system behaves. In addition to basic observability events about system activity, Tracee adds a collection of sophisticated security events that expose more advanced behavioral patterns. You can also easily add your own events using the popular Rego language. Tracee provides a rich filtering mechanism that allows you to eliminate noise and focus on specific workloads that matter most to you.

To learn more about Tracee, check out the documentation.

Quickstart

You can easily start experimenting with Tracee using the Docker image as follows:

docker run \
  --name tracee --rm -it \
  --pid=host --cgroupns=host --privileged \
  -v /etc/os-release:/etc/os-release-host:ro \
  -v /boot/config-$(uname -r):/boot/config-$(uname -r):ro \
  aquasec/tracee:$(uname -m)

To learn how to install Tracee in a production environment, check out the Kubernetes guide.


Tracee is an Aqua Security open source project.
Learn about our open source work and portfolio Here.
Join the community, and talk to us about any matter in GitHub Discussion or Slack.

Documentation

Index

Constants

This section is empty.

Variables

View Source
var RegoHelpersCode string

Functions

This section is empty.

Types

This section is empty.

Directories

Path Synopsis
api module
cmd
libbpfgo module
pkg
bufferdecoder
Package bufferdecoder implements simple translation between byte sequences and the user-defined structs.
Package bufferdecoder implements simple translation between byte sequences and the user-defined structs.
cmd
events
Invoked tracee-ebpf events from user mode
Invoked tracee-ebpf events from user mode
events/queue
package queue defines the interface and and implementation of a queue for events storage.
package queue defines the interface and and implementation of a queue for events storage.
events/sorting
Package sorting is responsible for sorting incoming events from the BPF programs chronologically.
Package sorting is responsible for sorting incoming events from the BPF programs chronologically.
signatures
tests
tracee-ebpf module
external Module
test/gob Module
tracee-rules module
types module

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL