Tracee

No entries match these filters. Clear filters

1. v0.24.0 (2025-11-14) Nov 14, 2025 · release notes

   Tracee v0.24.0 introduces evt triggers, new syscalls (security_sb_umount, open_file_ns/mount), and the traceectl CLI tool.

   • Adds evt trigger support for event-driven logic
   • Adds open_file_ns and open_file_mount events for filesystem tracking
   • Adds security_sb_umount eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. event detection
   • Adds heartbeat event type
   • Introduces traceectl CLI tool alongside the main Tracee service

   +2 more show less

   • Separates data field decoding types in the API payload
   • Reintroduces the --containers flag to filter output by container context

   7 details in Everything

2. v0.24.0 Nov 14, 2025 · release notes

   Tracee v0.24.0 adds traceectl CLI, new file/heartbeat events, event triggers, and richer data-field decoding types.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.24.0 https://github.com/aquasecurity/tracee.git
   # already have the repo? check out this version:
   $ git checkout v0.24.0

   • Adds traceectl, a new dedicated CLI tool bundled with Tracee for interacting with the Tracee service.
   • Adds open_file_ns and open_file_mount events for tracking file-open activity with namespace and mount context.
   • Adds a heartbeat event to signal that Tracee is alive and processing.
   • Introduces event triggers (evt trigger) enabling events to fire based on other event conditions.
   • Adds richer data field decoding types, separating decode type definitions for more precise event field interpretation.

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Data field decoding types are separated into distinct types (feat!: separate data field decoding types), which may break consumers relying on the previous unified decoding type structure.
3. v0.23.0 (2025-02-19) Feb 19, 2025 · release notes

   Tracee v0.23.0 adds stack_pivot and chmod_common events, unparsed flag helpers, epoch timestamps as standard

   • Adds the stack_pivot event type for detecting process execution context switches
   • Adds the chmod_common event type for monitoring permission changes
   • Introduces suspicious_syscall_source event to identify the origin of suspicious syscalls
   • Makes epoch timestamps standard (feat(time)!: epoch timestamps as standard) replacing previous time format
   • Removes default usage of parse-arguments, exposing raw argument values in engine output

   +4 more show less

   • Adds unparsed flag helper functions GetProtoHTTPRequestByName and GetProtoHTTPResponseByName to the helpers library
   • Reimplements ksymbols for improved kernel symbol resolution
   • Converts syscall arguments to names at the processing stage instead of earlier
   • Enables signatures consuming other signatures in the analyze engine

   9 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The default behavior for argument parsing changes: raw argument values are now returned by default instead of being parsed, requiring consumers to update signature logic or output processing.
4. v0.23.0 Feb 19, 2025 · release notes

   Tracee v0.23.0 adds stack_pivot and suspicious_syscall_source detections, chmod_common event, epoch timestamps, and kernel data filtering.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.23.0 https://github.com/aquasecurity/tracee.git
   # already have the repo? check out this version:
   $ git checkout v0.23.0

   └──▷ TRY IT
   Detect stack pivoting exploitation attempts in real time by enabling the new stack_pivot event.
   copy

   $ docker run --privileged --pid=host -v /etc/os-release:/etc/os-release -v /sys/kernel/security:/sys/kernel/security aquasec/tracee:0.23.0 --events stack_pivot

   Detect syscalls issued from suspicious (non-standard) memory regions to catch shellcode or injection activity.
   copy

   $ docker run --privileged --pid=host -v /etc/os-release:/etc/os-release -v /sys/kernel/security:/sys/kernel/security aquasec/tracee:0.23.0 --events suspicious_syscall_source

   Track all chmod-family permission change operations across processes using the new unified chmod_common event.
   copy

   $ docker run --privileged --pid=host -v /etc/os-release:/etc/os-release -v /sys/kernel/security:/sys/kernel/security aquasec/tracee:0.23.0 --events chmod_common

   • Adds suspicious_syscall_source event to detect syscalls originating from suspicious memory regions.
   • Adds stack_pivot event to detect stack pivoting techniques used in exploitation.
   • Adds chmod_common event to track permission change operations.
   • Introduces epoch timestamps as the standard time format for all events.
   • Adds kernel-side data filtering to reduce unnecessary event data sent to userspace.

   +7 more show less

   • Enables signatures to consume other signature findings in the analyze pipeline (chained detection logic).
   • Adds GetProtoHTTPRequestByName and GetProtoHTTPResponseByName signature helper functions for HTTP protocol inspection.
   • Adds EventCounts field to GetMetricsResponse in the gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. API.
   • Removes Rego signature support, leaving Go and Golang-based signatures as the supported path.
   • Removes default usage of parse-arguments, giving operators explicit control over argument parsing.
   • Restricts set_fs_pwd eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. hook to (f)chdir syscalls only, reducing noise.
   • Adds perf event write metrics for observability of eBPF pipeline throughput.

   12 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Epoch timestamps are now the standard for all events; integrations that relied on the previous timestamp format will receive differently formatted time values.
   • !Rego signature support has been removed; any signatures written in Rego will no longer be loaded or executed.
   • !parse-arguments is no longer enabled by default; deployments that depended on automatic argument parsing must explicitly enable it.
5. v0.22.6 Feb 19, 2025 · release notes

   Tracee v0.22.6 switches to epoch timestamps as the standard time format for all events.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.22.6 https://github.com/aquasecurity/tracee.git
   # already have the repo? check out this version:
   $ git checkout v0.22.6

   └──▷ BREAKING ON UPGRADE

   • !Timestamps are now emitted in epoch format by default; any pipeline or parser expecting the previous time format will break on upgrade.
6. v0.22.5 Dec 10, 2024 · release notes

   Tracee v0.22.5 adds perf event write metrics and refactors the event API context.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.22.5 https://github.com/aquasecurity/tracee.git
   # already have the repo? check out this version:
   $ git checkout v0.22.5

   • Adds a metric tracking perf event writes to monitor data flow through the performance events subsystem
   • Refactors the internal event structure and renames the context field within the event object

   2 details in Everything

7. v0.22.0 Aug 27, 2024 · release notes

   Tracee v0.22.0 adds new kernel events, packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. context, configurable pipeline sizing, and broader sys_enter/exit-free LSM hook coverage.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.22.0 https://github.com/aquasecurity/tracee.git
   # already have the repo? check out this version:
   $ git checkout v0.22.0

   • Adds security_task_setrlimit event to detect resource-limit manipulation attempts.
   • Adds security_settime64 event to detect system clock modification via the LSM hook.
   • Adds tracee_info event that emits metadata about the running Tracee instance.
   • Adds full-payload packet capture event containing complete packet contents for all captured packets.
   • Adds packet capture context, enriching captured packets with process/container metadata.

   +5 more show less

   • Adds path and ctime fields to the module_load event for richer kernel module load visibility.
   • Adds prev_comm field to sched_process_exec event, exposing the pre-exec process name.
   • Makes security_socket_setsockopt, security_file_open, security_socket_connect, security_socket_accept, mem_prot_alert, security_socket_bind, and set_fs_pwd events independent of sys_enter/sys_exit, improving compatibility across kernel versions.
   • Adds configurable eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. pipeline channel size, enabling tuning for high-throughput environments.
   • Adds baseline eBPF capability management, automatically computing required kernel capabilities.

   10 details in Everything

8. v0.21.0 Jun 25, 2024 · release notes

   Tracee v0.21.0 adds webhook configuration via helm values and custom templates, plus ArgVal signature helper

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.21.0 https://github.com/aquasecurity/tracee.git
   # already have the repo? check out this version:
   $ git checkout v0.21.0

   • Adds webhook configuration support in Helm chart values for outbound notifications
   • Introduces ArgVal signature helper function for building detection rules that inspect syscall arguments

   2 details in Everything

9. v0.20.0 Feb 14, 2024 · release notes

   Adds DNS Cache and pluggable writable data sources with a new Data Source gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. API in v0.20.0

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.20.0 https://github.com/aquasecurity/tracee.git
   # already have the repo? check out this version:
   $ git checkout v0.20.0

   └──▷ USE IT
   Configure pluggable data sources in your Tracee policy to add custom event ingestion pipelines.
   config copy

   # In tracee-policy.yaml:
   # datasources:
   #   my_custom_ds:
   #     type: writeable
   #     endpoint: tcp://localhost:9090

   • pluggable datasources enables custom, user-defined data sources to extend Tracee's event model beyond built-ins.
   • net_flow_tcp_begin is a new event that captures the beginning of TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections for flow analysis.
   • data source grpc service adds a gRPC API endpoint for interacting with the new data source system programmatically.
   • packet metadata type introduces structured packet metadata into the event stream, replacing ad-hoc fields.
   • ctime is added to the containers data source, providing container creation timestamps for auditing.

   +3 more show less

   • Threat objects with name and properties are now embedded in events for richer threat context.
   • signature name is exposed in the Event definition, allowing direct correlation of findings to signature rules.
   • signatures helpers are exposed as a Go module for external tooling integration.

   8 details in Everything

10. v0.18.0 Oct 6, 2023 · release notes

    Tracee v0.18.0 adds the analyze subcommand, process tree view, ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code.-based file capture filtering, and an initial gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. service for diagnostics and stream management.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18.0 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.18.0

    • Adds the analyze subcommand to perform post-hoc analysis of captured events
    • Introduces a process tree view (proctree) for visualizing parent-child relationships in traced processes
    • Enables filtering file capture by ELF type using the --filter-elf-type flag
    • Adds support for multiple values to the --signatures-dir flag to load signature directories from multiple paths
    • Allows users to specify which syscalls to monitor via the new hooked_syscalls event configuration

    +4 more show less

    • Introduces hidden_kernel_module events with updates for kernel 6.4 support
    • Adds atomic level control for loggers via the --log-level flag with precise granularity
    • Enables diagnostic checks via a new gRPC endpoint accessible through the diagnostic RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. service
    • Adds an initial gRPC service (tracee-rpc) to support streaming events and remote diagnostics

    9 details in Everything

11. v0.16.0 Jul 2, 2023 · release notes

    Tracee v0.16.0 adds analyze subcommand, signatures-dir flag expansion, eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. control plane signals, and aarch64 support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.0 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.16.0

    └──▷ USE IT
    Run the new analysis subcommand to evaluate policy configurations against trace data.
    shell copy

    tracee analyze --policy my_policy.yaml

    Pass multiple signature directories to --signatures-dir to load rules from different paths.
    shell copy

    tracee --signatures-dir ./sig1 --signatures-dir ./sig2

    Pull the new aarch64 image for running Tracee on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.-based hosts.
    shell copy

    docker pull docker.io/aquasec/tracee:aarch64-0.16.0

    • Adds the new tracee analyze subcommand for policy analysis workflows
    • Extends --signatures-dir flag to accept multiple values instead of just one path
    • Introduces eBPF control plane signals to manage probe and event groups dynamically
    • Changes hooked_syscalls event behavior to allow users to specify which syscalls to check

    4 details in Everything

12. v0.15.0 Jun 7, 2023 · release notes

    Tracee v0.15.0 adds bpf_attach events, read capture, not-equal operator parsing, and k8s enrichment defaults

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.0 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.15.0

    └──▷ TRY IT
    Trace raw tracepoint attachments to monitor eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. program lifecycle.
    copy

    $ tracee --events bpf_attach

    Capture file read operations using the new read capture feature.
    copy

    $ tracee --capture read

    • Adds bpf_attach event to trace raw tracepoints via eBPF attachment.
    • Adds read capture capability for tracing file reads in userspace.
    • Adds not-equal operator parsing to policy definitions.
    • Enables k8s enrichment by default in the Helm chart.
    • Adds DataSource type support for signatures in tracee events.

    5 details in Everything

13. v0.14.1 May 10, 2023 · release notes

    Tracee v0.14.1 adds PID namespace support and memory capture enhancements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.1 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.14.1

    • Adds support for running Tracee inside a PID namespace (pid ns).
    • Enhances memory capture to include the process ID and allows timestamps to be output as epoch or relative values.

    2 details in Everything

14. v0.14.0 May 3, 2023 · release notes

    Tracee v0.14.0 introduces unmarshalled trace types in signatures and drops default capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.0 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.14.0

    • capabilities are now dropped by default instead of being retained
    • Signatures can now use the new trace_types struct for unmarshalling events

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The tool no longer retains elevated capabilities by default; users must explicitly enable them if required
15. v0.13.0 Apr 1, 2023 · release notes

    Tracee v0.13.0 introduces Policies for scoped event capture, ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. builds, and new event signatures.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.0 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.13.0

    • Adds Policies feature to scope event capturing by container or Kubernetes context
    • Adds ARM64 architecture support via aarch64-0.13.0 Docker images and CI runners
    • Adds inotify_find_inode event signature to detect inode lookups by inotify
    • Adds process_execute_failed event signature to detect failed process execution attempts

    4 details in Everything

16. v0.12.0 Mar 3, 2023 · release notes

    Tracee v0.12.0 adds webhook printer, new syscall detections (vfs_utimes, do_truncate), and Fluent Forward output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.0 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.12.0

    • Adds webhook printer for sending findings to HTTP webhooks
    • Adds fluent_forward output option for syslog-compatible forwarding
    • Adds detection for the do_truncate syscall event
    • Adds detection for the vfs_utimes syscall event
    • Signs container images with cosign

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --trace flag is renamed to --filter
17. v0.10.0 Dec 16, 2022 · release notes

    Tracee v0.10.0 adds args and binary filters, network protocol events, custom rules via entrypoint, and event context filtering.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.0 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.10.0

    └──▷ TRY IT
    Filter syscalls by specific argument values using the new args filter.
    copy

    $ tracee --args-filter 'syscall=openat,fd,>0'

    Filter events by the name of the executable binary.
    copy

    $ tracee --binary-filter 'bash'

    Load custom rule files directly from a K8s entrypoint script without rebuilding the image.
    copy

    $ ./entrypoint.sh --custom-rules /path/to/rules/

    • Adds --args-filter flag to filter syscalls by their arguments
    • Adds new network protocol event types for DNS, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it., and UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. in the engine
    • Adds --binary-filter flag to filter events by binary name
    • Adds --event-context-filter flag to filter events using context metadata
    • Adds --custom-rules argument option to entrypoint.sh for loading custom signatures

    +2 more show less

    • Enables derived event pipeline filtering via events_pipeline filter rules
    • Adds container image field to the table printer output

    7 details in Everything

18. v0.9.0 Oct 21, 2022 · release notes

    Tracee v0.9.0 adds 20+ cloud-native detection signatures, new kernel events, and Kubernetes quickstart docs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.0 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.9.0

    • kallsyms_lookup_name and bpf_attach events available for tracing hooks
    • Adds signatures to detect process memory access (proc_mem_access), fileless execution, and credential theft attempts
    • New Helm configuration option postee makes the postee integration optional

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The device argument in the security_inode_unlink event is renamed to dev
19. v0.8.3 Sep 19, 2022 · release notes

    Tracee v0.8.3 adds a /healthz endpoint for tracee-ebpf and tracee-rules

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.3 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.8.3

    └──▷ TRY IT
    Verify the health status of the tracee-ebpf service via HTTP.
    copy

    $ curl http://localhost:3301/healthz

20. v0.8.2 Sep 12, 2022 · release notes

    Tracee v0.8.2 adds --caps allow-failed-drop and --caps cancel-drop CLI flags to bypass capability dropping.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.2 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.8.2

    └──▷ USE IT
    Run Tracee while keeping all original capabilities if one of the expected drops fails, useful for debugging permission issues on non-standard systems.
    shell copy

    tracee --caps allow-failed-drop

    Start Tracee without dropping any capabilities at all, overriding the default behavior for environments where privilege loss causes errors.
    shell copy

    tracee --caps cancel-drop

    • Adds --caps allow-failed-drop CLI flag to prevent Tracee from dropping capabilities when the operation fails
    • Adds --caps cancel-drop CLI flag to abort the capability dropping process entirely

    2 details in Everything

21. v0.8.1 Aug 11, 2022 · release notes

    Tracee v0.8.1 adds symbols_loaded event and exports tracee-ebpf init package

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.1 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.8.1

    • Adds the symbols_loaded event to monitor shared object exported symbols
    • Adds new Go package for initializing a tracee-ebpf object

    2 details in Everything

22. v0.8.0 Jul 14, 2022 · release notes

    Tracee v0.8.0 adds CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine.-based signature writing, postee Helm chart integration, and dozens of new eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. events.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.0 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.8.0

    • Writes Tracee-rules signatures in Common Expression Language (CEL) via the rules directory
    • Installs Tracee alongside Postee using a dedicated Helm chart template
    • Captures ICMP network traffic through net_packet eBPF events
    • Adds new eBPF event types including dns_query, dns_response, hooked_proc_fops, hidden_sockets, set_task_comm, security_socket_setsockopt, do_init_module, security_mmap_file, and shared_object_loaded
    • Enriches container events with data from multiple runtimes

    +1 more show less

    • Adds inode mode information to the sched_process_exec event and interp field for interpreter path

    6 details in Everything

23. v0.7.0 Mar 28, 2022 · release notes

    Tracee v0.7.0 adds Prometheus metrics export, eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. caching, and several new event types including security_path_symlink.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.0 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.7.0

    • Adds Prometheus support for exporting trace events as metrics
    • Adds existing_containers event to capture pre-existing containers at startup
    • Adds net_packet event for capturing network packet data
    • Adds security_path_symlink event for detecting symlink security operations
    • Adds container ID filtering capability to reduce trace scope

    +3 more show less

    • Adds eBPF events caching option to improve performance
    • Adds support for tracing many new 32 and 64 bit system calls
    • Updates docker images to include embedded eBPF CO-RE obj with BTFHUB support

    8 details in Everything

24. v0.6.5 Dec 6, 2021 · release notes

    Tracee v0.6.5 adds ctime to security_file_open events and filters containers by cgroup ID

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.5 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.6.5

    • Adds ctime field to security_file_open event data for tracking file change times
    • Introduces cgroup ID-based container filtering to resolve container IDs more reliably than previous methods
    • Adds READ_USER flag support for file read operations

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The exec-info event format is replaced by exec-hash, changing how execution events are reported
25. v0.6.4 Nov 15, 2021 · release notes

    Tracee v0.6.4 adds raw argument capture, ctime on exec events, kernel module capture, and new signatures.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.4 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.6.4

    • Adds option to output raw arguments for various events via new flags
    • Adds ctime field to the sched-process-exec event
    • Adds signature for cgroup release_agent modification
    • Adds security_kernel_post_read_file detection and capture of kernel modules

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --security-alerts flag is removed; remove it from existing commands or scripts
26. v0.6.3 Oct 13, 2021 · release notes

    Tracee v0.6.3 adds the --list-events CLI flag to enumerate supported eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. events.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.3 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.6.3

    └──▷ TRY IT
    Quickly check which system calls or events are supported before writing a filter rule.
    copy

    $ tracee --list-events

27. v0.6.2 Oct 9, 2021 · release notes

    Tracee v0.6.2 adds --rego-target, partial evaluation flag, and prepared events flag to tracee-ebpf.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.2 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.6.2

    └──▷ USE IT
    Select the WASMWASMA binary instruction format for a stack-based virtual machine, maintained by the W3C, that lets code compiled from any language run at near-native speed inside a sandboxed environment across browsers and servers. target for Rego signature evaluation instead of the default OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. runtime.
    shell copy

    tracee-ebpf --rego-target wasm

    Enable partial evaluation to optimize tracee-rules by pre-computing static parts of Rego policies.
    shell copy

    tracee-rules --partial-eval

    Use the prepared events optimization in tracee-ebpf for potentially faster event processing.
    shell copy

    tracee-ebpf --prepared-events

    • Adds --rego-target flag to tracee-ebpf to select the Rego runtime target
    • Adds --partial-eval flag to tracee-rules to enable partial evaluation of signatures

    2 details in Everything

28. v0.6.1 Sep 4, 2021 · release notes

    Tracee v0.6.1 adds sched_process_exec to default events, --output ignore, and Pprof endpoints for metrics

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.1 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.6.1

    └──▷ TRY IT
    Trace process execution events without persisting any output for ephemeral checks.
    copy

    $ tracee-ebpf --output ignore

    Access metrics and debug data from the rules engine via HTTP.
    copy

    $ curl http://localhost:6060/debug/pprof/profile

    • Adds sched_process_exec to the default set of traced syscalls.
    • Adds the --output ignore flag to tracee-ebpf to discard all event output.
    • Enables pprof profiling endpoints on tracee-rules for performance monitoring.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removes the --capture all flag, replacing it with explicit capture options.
29. v0.6.0 Aug 3, 2021 · release notes

    Tracee v0.6.0 adds network capture, epoch timestamps, OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. evaluation via tracee-rules engine, and exportable channels for third-party integrations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.0 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.6.0

    • Adds security_kernel_read_file LSM hook to detect kernel file read operations.
    • Adds TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. handshake packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. using a tcp_connect kprobe.
    • Adds network activity capture events (capture network).
    • Adds epoch timestamp field to tracee-ebpf output via the new epoch timestamp feature.
    • Adds event origin signature filtering capability (Feature/event origin signature filter).

    +4 more show less

    • Adds LSM hook support to event sets via add lsm hooks to event sets.
    • Enables evaluating parsed input with OPA in tracee-rules.
    • Adds Close, LoadSignature, and UnloadSignature functions to the tracee-rules Engine API.
    • Adds an exportable channel into the Config struct for third-party apps to read events without printer dependencies.

    9 details in Everything

30. v0.5.3 Jun 15, 2021 · release notes

    Tracee v0.5.3 introduces Profiler Mode and adds container ID to event context

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.3 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.5.3

    • feat: Tracee Profiler Mode is now available for application profiling workflows.
    • The event context object now includes the container_id field for container-aware tracing.

    2 details in Everything

31. v0.5.2 Jun 3, 2021 · release notes

    Tracee v0.5.2 adds /etc/ld.so.preload write detection and kernel config into BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. hashmap

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.2 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.5.2

    • Add detection for writing into /etc/ld.so.preload
    • Load kernel config into bpf hashmap

    2 details in Everything

32. v0.5.1 Apr 18, 2021 · release notes

    Tracee v0.5.1 adds Go template support for stdout and webhook output, signature versioning, wildcard event suffixes, and --list version details.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.1 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.5.1

    └──▷ USE IT
    Capture all file open events by using a wildcard suffix instead of naming each syscall.
    shell copy

    tracee-ebpf --capture-all-files -r 'open*'

    • --list now prints the version string alongside each loaded rule signature
    • Signatures gain explicit versioning metadata via Signature Metadata IDs
    • Event filters now accept wildcard suffixes (e.g. open*) for flexible matching
    • Stdout output format is controlled by Go templates instead of hardcoded structs
    • Webhook integration renders messages using Go templates for customizable formatting

    5 details in Everything

33. v0.5.0 Feb 18, 2021 · release notes

    Tracee v0.5.0 introduces a Rego-based signature engine and tracee-ebpf binary with new eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. events.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.0 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.5.0

    • Adds tracee-ebpf as the primary executable (renamed from tracee) and adds support for the switch_task_ns and commit_creds eBPF events
    • Enables writing detection signatures in Rego, allowing users to convert existing Go-based signatures to .rego format
    • Adds --list flag to output a list of available signatures with improved formatting

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The main executable is now named tracee-ebpf instead of tracee.
34. v0.4.0 Jan 24, 2021 · release notes

    Tracee v0.4.0 adds filter-based flag for UTS/COMM/pidns/mntns and --stack-addresses output option

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.0 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.4.0

    └──▷ TRY IT
    Enable stack trace logging in the JSON output for deep debugging
    copy

    $ tracee --output json:pretty --stack-addresses

    Use the new unified filter flag to trace only events from a specific process ID namespace
    copy

    $ tracee --filter pidns=1000

    • Introduces unified --filter flag replacing separate trace modes (pid, mntns, pidns, follow)
    • Supports filtering events by argument with prefix operator for common filters

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --capture flag-file-write option is removed; use the new unified filter system instead
35. v0.3.1 Dec 9, 2020 · release notes

    Adds UID filters with comparison operators and security_inode_unlink event detection to Tracee v0.3.1

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.1 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.3.1

    • Add the ability to specify filters (such as UID) using comparison operators (=, !=, >, <)

    1 detail in Everything

36. v0.3.0 Nov 29, 2020 · release notes

    Tracee v0.3.0 adds --filter, --output=gotemplate, and --trace flags for new runtime configuration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.0 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.3.0

    └──▷ USE IT
    Trace only events from specific UIDs using the new filter syntax
    shell copy

    tracee --filter uid=1000,2000

    Trace a specific process by PID using the new --trace flag
    shell copy

    tracee --trace pid=1234

    • Adds --filter flag to the CLI to allow field-based event filtering (e.g., --filter uid=1000)
    • Adds --trace flag as a replacement for --pid and --container to specify trace targets

    2 details in Everything

37. v0.0.3 Aug 5, 2020 · release notes

    Tracee v0.0.3 adds support for tracing by PID, new table formatting options, and container host PID visibility.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.3 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.0.3

    • Adds --pid flag to trace specific processes
    • Introduces new table output formatting with comma-separated arguments and widened PID columns
    • Enables saving writes to /dev/null by PID for targeted capture

    3 details in Everything

38. v0.0.2 Jul 23, 2020 · release notes

    Adds new configuration flags for vfs_write, output formats, and event filters in Tracee v0.0.2

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.2 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.0.2

    • Adds --gob flag to enable gob output format
    • Adds --vfs-write-filter option to filter file writes up to 64 characters
    • Adds --exclude-events flag to exclude specific events from tracing
    • Adds configuration flags for vfs_write capture options

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !raw_syscalls are no longer printed by default
    • !The save_args key is now required to be unique
39. v0.0.1 May 18, 2020 · release notes

    First release of Tracee, a cyber tool for runtime security and forensics using eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.1 https://github.com/aquasecurity/tracee.git
    # already have the repo? check out this version:
    $ git checkout v0.0.1

    • Adds support for security_file_open LSM hook to capture file open events
    • Adds --event flag (renamed from events-to-trace) to filter which syscalls to trace
    • Adds container tracing capability by using UTS namespace node name to identify container ID
    • Adds optional --exec-env flag to display environment variables during execve events
    • Adds system tracing mode for broad-scope event capture

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !--events-to-trace flag is renamed to --event