https://cybertoolchain.io/tools/tracee New releases and features in Tracee, tracked by The Cyber Toolchain. en Fri, 14 Nov 2025 15:02:56 GMT https://github.com/aquasecurity/tracee/releases/tag/v0.24.0 https://github.com/aquasecurity/tracee/releases/tag/v0.24.0 Fri, 14 Nov 2025 15:02:56 GMT Tracee v0.24.0 introduces evt triggers, new syscalls (security_sb_umount, open_file_ns/mount), and the traceectl CLI tool. • Adds `evt` trigger support for event-driven logic • Adds `open_file_ns` and `open_file_mount` events for filesystem tracking • Adds `security_sb_umount` eBPF event detection • Adds `heartbeat` event type • Introduces `traceectl` CLI tool alongside the main Tracee service • Separates data field decoding types in the API payload • Reintroduces the `--containers` flag to filter output by container context Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.24.0 https://github.com/aquasecurity/tracee/releases/tag/v0.24.0 Fri, 14 Nov 2025 14:41:20 GMT Tracee v0.24.0 adds traceectl CLI, new file/heartbeat events, event triggers, and richer data-field decoding types. • Adds `traceectl`, a new dedicated CLI tool bundled with Tracee for interacting with the Tracee service. • Adds `open_file_ns` and `open_file_mount` events for tracking file-open activity with namespace and mount context. • Adds a `heartbeat` event to signal that Tracee is alive and processing. • Introduces event triggers (`evt trigger`) enabling events to fire based on other event conditions. • Adds richer data field decoding types, separating decode type definitions for more precise event field interpretation. Breaking changes: • Data field decoding types are separated into distinct types (`feat!: separate data field decoding types`), which may break consumers relying on the previous unified decoding type structure. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.23.0 https://github.com/aquasecurity/tracee/releases/tag/v0.23.0 Wed, 19 Feb 2025 16:23:37 GMT Tracee v0.23.0 adds stack_pivot and chmod_common events, unparsed flag helpers, epoch timestamps as standard • Adds the `stack_pivot` event type for detecting process execution context switches • Adds the `chmod_common` event type for monitoring permission changes • Introduces `suspicious_syscall_source` event to identify the origin of suspicious syscalls • Makes epoch timestamps standard (`feat(time)!: epoch timestamps as standard`) replacing previous time format • Removes default usage of `parse-arguments`, exposing raw argument values in engine output • Adds unparsed flag helper functions `GetProtoHTTPRequestByName` and `GetProtoHTTPResponseByName` to the helpers library • Reimplements `ksymbols` for improved kernel symbol resolution • Converts syscall arguments to names at the processing stage instead of earlier • Enables signatures consuming other signatures in the analyze engine Breaking changes: • The default behavior for argument parsing changes: raw argument values are now returned by default instead of being parsed, requiring consumers to update signature logic or output processing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.23.0 https://github.com/aquasecurity/tracee/releases/tag/v0.23.0 Wed, 19 Feb 2025 15:08:31 GMT Tracee v0.23.0 adds stack_pivot and suspicious_syscall_source detections, chmod_common event, epoch timestamps, and kernel data filtering. • Adds `suspicious_syscall_source` event to detect syscalls originating from suspicious memory regions. • Adds `stack_pivot` event to detect stack pivoting techniques used in exploitation. • Adds `chmod_common` event to track permission change operations. • Introduces epoch timestamps as the standard time format for all events. • Adds kernel-side data filtering to reduce unnecessary event data sent to userspace. • Enables signatures to consume other signature findings in the `analyze` pipeline (chained detection logic). • Adds `GetProtoHTTPRequestByName` and `GetProtoHTTPResponseByName` signature helper functions for HTTP protocol inspection. • Adds `EventCounts` field to `GetMetricsResponse` in the gRPC API. • Removes Rego signature support, leaving Go and Golang-based signatures as the supported path. • Removes default usage of `parse-arguments`, giving operators explicit control over argument parsing. • Restricts `set_fs_pwd` eBPF hook to `(f)chdir` syscalls only, reducing noise. • Adds perf event write metrics for observability of eBPF pipeline throughput. Breaking changes: • Epoch timestamps are now the standard for all events; integrations that relied on the previous timestamp format will receive differently formatted time values. • Rego signature support has been removed; any signatures written in Rego will no longer be loaded or executed. • `parse-arguments` is no longer enabled by default; deployments that depended on automatic argument parsing must explicitly enable it. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.22.6 https://github.com/aquasecurity/tracee/releases/tag/v0.22.6 Wed, 19 Feb 2025 11:08:24 GMT Tracee v0.22.6 switches to epoch timestamps as the standard time format for all events. • Adopts epoch timestamps as the standard time representation across all Tracee events. Breaking changes: • Timestamps are now emitted in epoch format by default; any pipeline or parser expecting the previous time format will break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.22.5 https://github.com/aquasecurity/tracee/releases/tag/v0.22.5 Tue, 10 Dec 2024 16:54:38 GMT Tracee v0.22.5 adds perf event write metrics and refactors the event API context. • Adds a metric tracking `perf event writes` to monitor data flow through the performance events subsystem • Refactors the internal event structure and renames the context field within the event object Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.22.0 https://github.com/aquasecurity/tracee/releases/tag/v0.22.0 Tue, 27 Aug 2024 23:04:57 GMT Tracee v0.22.0 adds new kernel events, packet capture context, configurable pipeline sizing, and broader sys_enter/exit-free LSM hook coverage. • Adds `security_task_setrlimit` event to detect resource-limit manipulation attempts. • Adds `security_settime64` event to detect system clock modification via the LSM hook. • Adds `tracee_info` event that emits metadata about the running Tracee instance. • Adds full-payload packet capture event containing complete packet contents for all captured packets. • Adds packet capture context, enriching captured packets with process/container metadata. • Adds `path` and `ctime` fields to the `module_load` event for richer kernel module load visibility. • Adds `prev_comm` field to `sched_process_exec` event, exposing the pre-exec process name. • Makes `security_socket_setsockopt`, `security_file_open`, `security_socket_connect`, `security_socket_accept`, `mem_prot_alert`, `security_socket_bind`, and `set_fs_pwd` events independent of `sys_enter`/`sys_exit`, improving compatibility across kernel versions. • Adds configurable eBPF pipeline channel size, enabling tuning for high-throughput environments. • Adds baseline eBPF capability management, automatically computing required kernel capabilities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.21.0 https://github.com/aquasecurity/tracee/releases/tag/v0.21.0 Tue, 25 Jun 2024 13:37:06 GMT Tracee v0.21.0 adds webhook configuration via helm values and custom templates, plus ArgVal signature helper • Adds `webhook` configuration support in Helm chart values for outbound notifications • Introduces `ArgVal` signature helper function for building detection rules that inspect syscall arguments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.20.0 https://github.com/aquasecurity/tracee/releases/tag/v0.20.0 Wed, 14 Feb 2024 18:05:02 GMT Adds DNS Cache and pluggable writable data sources with a new Data Source gRPC API in v0.20.0 • `pluggable datasources` enables custom, user-defined data sources to extend Tracee's event model beyond built-ins. • `net_flow_tcp_begin` is a new event that captures the beginning of TCP connections for flow analysis. • `data source grpc service` adds a gRPC API endpoint for interacting with the new data source system programmatically. • `packet metadata type` introduces structured packet metadata into the event stream, replacing ad-hoc fields. • `ctime` is added to the containers data source, providing container creation timestamps for auditing. • `Threat` objects with `name` and `properties` are now embedded in events for richer threat context. • `signature name` is exposed in the Event definition, allowing direct correlation of findings to signature rules. • `signatures helpers` are exposed as a Go module for external tooling integration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.18.0 https://github.com/aquasecurity/tracee/releases/tag/v0.18.0 Fri, 06 Oct 2023 20:50:16 GMT Tracee v0.18.0 adds the `analyze` subcommand, process tree view, ELF-based file capture filtering, and an initial gRPC service for diagnostics and stream management. • Adds the `analyze` subcommand to perform post-hoc analysis of captured events • Introduces a process tree view (`proctree`) for visualizing parent-child relationships in traced processes • Enables filtering file capture by ELF type using the `--filter-elf-type` flag • Adds support for multiple values to the `--signatures-dir` flag to load signature directories from multiple paths • Allows users to specify which syscalls to monitor via the new `hooked_syscalls` event configuration • Introduces `hidden_kernel_module` events with updates for kernel 6.4 support • Adds atomic level control for loggers via the `--log-level` flag with precise granularity • Enables diagnostic checks via a new gRPC endpoint accessible through the `diagnostic` RPC service • Adds an initial gRPC service (`tracee-rpc`) to support streaming events and remote diagnostics Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.15.0 https://github.com/aquasecurity/tracee/releases/tag/v0.15.0 Wed, 07 Jun 2023 13:44:14 GMT Tracee v0.15.0 adds bpf_attach events, read capture, not-equal operator parsing, and k8s enrichment defaults • Adds `bpf_attach` event to trace raw tracepoints via eBPF attachment. • Adds read capture capability for tracing file reads in userspace. • Adds `not-equal` operator parsing to policy definitions. • Enables k8s enrichment by default in the Helm chart. • Adds `DataSource` type support for signatures in tracee events. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.14.1 https://github.com/aquasecurity/tracee/releases/tag/v0.14.1 Wed, 10 May 2023 04:45:59 GMT Tracee v0.14.1 adds PID namespace support and memory capture enhancements. • Adds support for running Tracee inside a PID namespace (`pid ns`). • Enhances memory capture to include the process ID and allows timestamps to be output as epoch or relative values. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.14.0 https://github.com/aquasecurity/tracee/releases/tag/v0.14.0 Wed, 03 May 2023 06:30:52 GMT Tracee v0.14.0 introduces unmarshalled trace types in signatures and drops default capabilities. • `capabilities` are now dropped by default instead of being retained • Signatures can now use the new `trace_types` struct for unmarshalling events Breaking changes: • The tool no longer retains elevated capabilities by default; users must explicitly enable them if required Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.13.0 https://github.com/aquasecurity/tracee/releases/tag/v0.13.0 Sat, 01 Apr 2023 05:13:44 GMT Tracee v0.13.0 introduces Policies for scoped event capture, ARM64 builds, and new event signatures. • Adds `Policies` feature to scope event capturing by container or Kubernetes context • Adds ARM64 architecture support via `aarch64-0.13.0` Docker images and CI runners • Adds `inotify_find_inode` event signature to detect inode lookups by inotify • Adds `process_execute_failed` event signature to detect failed process execution attempts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.12.0 https://github.com/aquasecurity/tracee/releases/tag/v0.12.0 Fri, 03 Mar 2023 18:47:33 GMT Tracee v0.12.0 adds webhook printer, new syscall detections (vfs_utimes, do_truncate), and Fluent Forward output. • Adds `webhook` printer for sending findings to HTTP webhooks • Adds `fluent_forward` output option for syslog-compatible forwarding • Adds detection for the `do_truncate` syscall event • Adds detection for the `vfs_utimes` syscall event • Signs container images with cosign Breaking changes: • The `--trace` flag is renamed to `--filter` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.9.0 https://github.com/aquasecurity/tracee/releases/tag/v0.9.0 Fri, 21 Oct 2022 21:26:54 GMT Tracee v0.9.0 adds 20+ cloud-native detection signatures, new kernel events, and Kubernetes quickstart docs • `kallsyms_lookup_name` and `bpf_attach` events available for tracing hooks • Adds signatures to detect process memory access (`proc_mem_access`), fileless execution, and credential theft attempts • New Helm configuration option `postee` makes the postee integration optional Breaking changes: • The `device` argument in the `security_inode_unlink` event is renamed to `dev` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.8.3 https://github.com/aquasecurity/tracee/releases/tag/v0.8.3 Mon, 19 Sep 2022 19:50:15 GMT Tracee v0.8.3 adds a /healthz endpoint for tracee-ebpf and tracee-rules • Adds a new `/healthz` HTTP endpoint to both `tracee-ebpf` and `tracee-rules` services Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.8.0 https://github.com/aquasecurity/tracee/releases/tag/v0.8.0 Thu, 14 Jul 2022 21:38:43 GMT Tracee v0.8.0 adds CEL-based signature writing, postee Helm chart integration, and dozens of new eBPF events. • Writes Tracee-rules signatures in Common Expression Language (CEL) via the `rules` directory • Installs Tracee alongside Postee using a dedicated Helm chart template • Captures ICMP network traffic through `net_packet` eBPF events • Adds new eBPF event types including `dns_query`, `dns_response`, `hooked_proc_fops`, `hidden_sockets`, `set_task_comm`, `security_socket_setsockopt`, `do_init_module`, `security_mmap_file`, and `shared_object_loaded` • Enriches container events with data from multiple runtimes • Adds inode mode information to the `sched_process_exec` event and `interp` field for interpreter path Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.7.0 https://github.com/aquasecurity/tracee/releases/tag/v0.7.0 Mon, 28 Mar 2022 21:27:19 GMT Tracee v0.7.0 adds Prometheus metrics export, eBPF caching, and several new event types including security_path_symlink. • Adds `Prometheus` support for exporting trace events as metrics • Adds `existing_containers` event to capture pre-existing containers at startup • Adds `net_packet` event for capturing network packet data • Adds `security_path_symlink` event for detecting symlink security operations • Adds container ID filtering capability to reduce trace scope • Adds eBPF events caching option to improve performance • Adds support for tracing many new 32 and 64 bit system calls • Updates docker images to include embedded eBPF CO-RE obj with BTFHUB support Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.6.5 https://github.com/aquasecurity/tracee/releases/tag/v0.6.5 Mon, 06 Dec 2021 16:10:36 GMT Tracee v0.6.5 adds ctime to security_file_open events and filters containers by cgroup ID • Adds `ctime` field to `security_file_open` event data for tracking file change times • Introduces cgroup ID-based container filtering to resolve container IDs more reliably than previous methods • Adds `READ_USER` flag support for file read operations Breaking changes: • The `exec-info` event format is replaced by `exec-hash`, changing how execution events are reported Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee https://github.com/aquasecurity/tracee/releases/tag/v0.6.4 https://github.com/aquasecurity/tracee/releases/tag/v0.6.4 Mon, 15 Nov 2021 20:03:52 GMT Tracee v0.6.4 adds raw argument capture, ctime on exec events, kernel module capture, and new signatures. • Adds option to output raw arguments for various events via new flags • Adds `ctime` field to the `sched-process-exec` event • Adds signature for `cgroup release_agent` modification • Adds `security_kernel_post_read_file` detection and capture of kernel modules Breaking changes: • The `--security-alerts` flag is removed; remove it from existing commands or scripts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/tracee