Tracee

Tracee is designed to enhance runtime security and observability for Linux systems and applications. Utilizing eBPF technology, it captures system events and exposes them for analysis, helping users detect both standard system activities and suspicious behaviors. The tool is compatible with various Linux distributions and can be deployed using Docker or Kubernetes, making it suitable for developers and security professionals looking to monitor and secure their environments.