The Story of Tracee: The Path to Runtime Security Tool

Tracee is an open-source eBPF-based runtime security and forensics tool for Linux from Aqua Security. The report explains Tracee's evolution from basic syscall tracing to a robust runtime detection platform with Tracee-eBPF (event collection) and Tracee-rules (behavioral detection), lists built-in detection signatures, and highlights v0.6.0 improvements including CO:RE portability, network capture, and new trace events.