Tracee: Runtime Security and Forensics using eBPF¶
Tracee is a Runtime Security and forensics tool for Linux. It is using Linux eBPF technology to trace your system and applications at runtime, and analyze collected events to detect suspicious behavioral patterns. It is delivered as a Docker image that monitors the OS and detects suspicious behavior based on a predefined set of behavioral patterns.
Watch a quick video demo of Tracee:
Check out the Tracee video hub for more videos.
Before you proceed, make sure you follow the minimum requirements for running Tracee.
- Running tracee:latest
docker run \ --name tracee --rm -it \ --pid=host --cgroupns=host --privileged \ -v /etc/os-release:/etc/os-release-host:ro \ -e LIBBPFGO_OSRELEASE_FILE=/etc/os-release-host \ aquasec/tracee:0.7.0
- Running tracee:full
docker run --name tracee --rm -it \ --pid=host --cgroupns=host --privileged \ -v /etc/os-release:/etc/os-release-host:ro \ -e LIBBPFGO_OSRELEASE_FILE=/etc/os-release-host \ -v /usr/src:/usr/src:ro \ -v /lib/modules:/lib/modules:ro \ -v /tmp/tracee:/tmp/tracee:rw \ aquasec/tracee:full-0.7.0
The default (latest) image is lightweight and portable. It is supposed to
support different kernel versions without having to build source code. If
the host kernel does not support BTF then you may use the full container
image. The full container will compile an eBPF object during startup, if you do
not have one already cached in
You may need to change the volume mounts for the kernel headers based on your setup. See Linux Headers section for more info.
This will run Tracee with default settings and start reporting detections to standard output. In order to simulate a suspicious behavior, you can simply run:
in another terminal. This will trigger the "Anti-Debugging" signature, which is loaded by default, and you will get a warning:
INFO: probing tracee-ebpf capabilities... INFO: starting tracee-ebpf... INFO: starting tracee-rules... Loaded 14 signature(s): [TRC-1 TRC-13 TRC-2 TRC-14 TRC-3 TRC-11 TRC-9 TRC-4 TRC-5 TRC-12 TRC-8 TRC-6 TRC-10 TRC-7] Serving metrics endpoint at :3366 Serving metrics endpoint at :4466 *** Detection *** Time: 2022-03-25T08:04:22Z Signature ID: TRC-2 Signature: Anti-Debugging Data: map Command: strace Hostname: ubuntu-impish
In some cases, you might want to leverage Tracee's eBPF event collection
capabilities directly, without involving the detection engine. This might be
useful for debugging/troubleshooting/analysis/research/education. In this case,
you can run tracee exporting
TRACEE_EBPF_ONLY=1 environment variable.
docker run \ --name tracee --rm -it \ --pid=host --cgroupns=host --privileged \ -v /etc/os-release:/etc/os-release-host:ro \ -e LIBBPFGO_OSRELEASE_FILE=/etc/os-release-host \ -e TRACEE_EBPF_ONLY=1 \ aquasec/tracee:0.7.0
See documentation or add the
--help flag for more.
Tracee is composed of the following sub-projects, which are hosted in the aquasecurity/tracee repository:
- Tracee-eBPF - Linux Tracing and Forensics using eBPF
- Tracee-Rules - Runtime Security Detection Engine