Linux Tracee

2021-07-05 51 words One minute

Contents

Tracee

Runtime Security and Forensics using eBPF.

Command Options

Binding

Mount	Mode	Description
/lib/modules/	Read Only	Kernel Headers
/usr/src	Read Only	Kernel Headers
/tmp/tracee	Default	Default workspace

Additional Capability

Capabiltity

--privileged

Command Examples

Standard Output(Default)

1
docker run --name tracee --rm --privileged -v /lib/modules/:/lib/modules/:ro -v /usr/src:/usr/src:ro -v /tmp/tracee:/tmp/tracee -it aquasec/tracee:latest