tracee

Tracee is an open-source Linux runtime security and forensics tool from Aqua Security. Using eBPF, it collects system events and detects suspicious behavior, with Docker and Kubernetes deployment for runtime threat detection.