Tracee
Boston, United States and Ramat Gan, Israel
What it is
Tracee is a free Linux runtime security and observability tool that uses eBPF to monitor system calls, network activity, and file operations in real time. It creates events when it identifies behavior patterns that may indicate suspicious activity or security threats, with context such as process lineage, file paths, and network connections. Listed uses include security and compliance monitoring, troubleshooting, and forensic investigation. The project describes monitoring without code changes, low overhead, container awareness, and flexible policies. Tracee can be deployed as an executable binary, a Docker Hub container image, or a Helm chart in Aqua Security's registry; its quickstart documents installation on Kubernetes with the Aqua Helm chart. Prometheus scraping is supported by default, with metrics at :3366/metrics. Tracee supports x86 and arm64 processors and requires a compatible Linux kernel. Documented long-term supported kernel versions include 5.4, 5.10, 5.15, 6.2, and 6.5; some distribution kernels may also be supported. Instrumenting the kernel requires elevated capabilities, with privileged or root execution described as the easiest setup. Tracee does not run on macOS itself, though it can run in a Linux VM and observe that VM.
For and against
For
- Monitors system calls, network activity, and file operations.
- Provides event context including process lineage and file paths.
- Supports Kubernetes deployment with an Aqua Helm chart.
- Prometheus metrics are available by default.
Against
- Linux only; it does not run on macOS itself.
- Requires a compatible kernel and elevated capabilities.
- Privileged or root execution is the easiest setup.
The verdict
Tracee provides Linux-focused runtime events and observability, with deployment options for binaries, containers, and Helm. Its OS, kernel, and permission requirements are important to account for before deployment.
Who it suits
Tracee may suit teams seeking Linux runtime security monitoring, compliance monitoring, troubleshooting, or forensic investigation. It is for environments able to meet its compatible-kernel and elevated-capability requirements.
Plans and prices
Tracee
Open source project · Linux only · requires compatible kernel and elevated capabilities
Read 5 Oct 2026 · aquasecurity.github.io
On the record
- Architecture
- Tracee supports x86 and arm64 processors.aquasecurity.github.io · read 5 Oct 2026
- Deployment
- Tracee is available as an executable binary, a Docker Hub container image, and a Helm chart in Aqua Security's registry.aquasecurity.github.io · read 5 Oct 2026
- Detection
- Tracee identifies suspicious behavior patterns and potential security threats and generates real-time events.aquasecurity.github.io · read 5 Oct 2026
- Features
- The project lists monitoring without code changes, low overhead, container awareness, flexible policies, and event context such as process lineage, file paths, and network connections.aquasecurity.github.io · read 5 Oct 2026
- Integrations
- Tracee supports Prometheus scraping by default, with metrics available at :3366/metrics.aquasecurity.github.io · read 5 Oct 2026
- Kernel compatibility
- The prerequisites page names long-term supported kernel versions 5.4, 5.10, 5.15, 6.2, and 6.5, and notes that distribution kernels may also be supported.aquasecurity.github.io · read 5 Oct 2026
- Kubernetes
- The quickstart documents installing Tracee on Kubernetes with the Aqua Helm chart.aquasecurity.github.io · read 5 Oct 2026
- Linux requirement
- Tracee depends heavily on Linux and does not support other operating systems.aquasecurity.github.io · read 5 Oct 2026
- Mac support
- Tracee does not run on macOS itself; it can run inside a Linux VM, where it sees the VM rather than the Mac host.aquasecurity.github.io · read 5 Oct 2026
- Permissions
- Tracee needs non-trivial capabilities to instrument the kernel; the documentation says the easiest setup is running it as privileged or root.aquasecurity.github.io · read 5 Oct 2026
- Security detail
- Tracee documents LSM-based events as a way to cross-reference syscall events and mitigate a race condition in reading user-program information.aquasecurity.github.io · read 5 Oct 2026
- Support
- The project directs users to GitHub Discussions and Slack for community discussion and to GitHub issues for trouble reports and feedback.aquasecurity.github.io · read 5 Oct 2026
- Use cases
- Listed use cases include security monitoring, compliance monitoring, troubleshooting, and forensic investigation.aquasecurity.github.io · read 5 Oct 2026
- What it does
- Tracee is a runtime security and observability tool that uses eBPF to monitor Linux system calls, network activity, and file operations in real time.aquasecurity.github.io · read 5 Oct 2026
