What it does
Tracee uses eBPF to monitor Linux system calls, process activity, files and networking, with configurable security detections and contextual events.
Tracee is useful when a runtime question needs system-call or file activity with process context. Its documentation describes configurable policies and container awareness as part of that observation. Choose the event set around a specific investigation or workload baseline. More telemetry creates review and retention work, so identify the consumer of the events before expanding collection. The same runtime data can support troubleshooting or security analysis; the policy determines the defensive purpose.
Strengths
- Context-rich Linux runtime events and detection policies
Best for
- Defenders investigating host and container runtime behavior
Sources
- Tracee (Oct 26, 2026)