Skip to content
SPECIFICTION
Get listed

Tracee

aquasecurity.github.io

Free plan LinuxSelf-hosted
Visit aquasecurity.github.io
Spec score 7.4 #13 of 23 in Cloud Workload Protection Platforms

What it is

Tracee is a free, open-source runtime security and observability tool for Linux. Using eBPF, it watches system calls, network activity, and file operations in real time, then emits events for behavior patterns that may indicate threats. Events can include process lineage, file paths, and network connections. Listed uses include security monitoring, compliance monitoring, troubleshooting, and forensic investigation. Tracee is designed to operate without code changes and lists low overhead, container awareness, and adjustable policies. Deployment options are an executable binary, a Docker Hub image, or a Helm chart in Aqua Security’s registry; the quickstart covers Kubernetes installation with that chart. Prometheus scraping is enabled by default, with metrics at :3366/metrics. It supports x86 and arm64 processors and documents long-term kernel versions 5.4, 5.10, 5.15, 6.2, and 6.5, while some distribution kernels may work. Instrumentation needs elevated capabilities, with privileged or root execution described as easiest. Tracee does not run directly on macOS.

Spec sheet

What it does
Tracee is a runtime security and observability tool that uses eBPF to monitor Linux system calls, network activity, and file operations in real time.Read 5 Oct 2026 · aquasecurity.github.io
Deployment
Tracee is available as an executable binary, a Docker Hub container image, and a Helm chart in Aqua Security's registry.Read 5 Oct 2026 · aquasecurity.github.io
Integrations
Tracee supports Prometheus scraping by default, with metrics available at :3366/metrics.Read 5 Oct 2026 · aquasecurity.github.io
Support
The project directs users to GitHub Discussions and Slack for community discussion and to GitHub issues for trouble reports and feedback.Read 5 Oct 2026 · aquasecurity.github.io
Headquarters
Boston, United States and Ramat Gan, IsraelRead 28 Sep 2026 · aquasecurity.github.io
Founded
2019Read 28 Sep 2026 · aquasecurity.github.io
Architecture
Tracee supports x86 and arm64 processors.Read 5 Oct 2026 · aquasecurity.github.io
Detection
Tracee identifies suspicious behavior patterns and potential security threats and generates real-time events.Read 5 Oct 2026 · aquasecurity.github.io
Features
The project lists monitoring without code changes, low overhead, container awareness, flexible policies, and event context such as process lineage, file paths, and network connections.Read 5 Oct 2026 · aquasecurity.github.io
Kernel compatibility
The prerequisites page names long-term supported kernel versions 5.4, 5.10, 5.15, 6.2, and 6.5, and notes that distribution kernels may also be supported.Read 5 Oct 2026 · aquasecurity.github.io
Kubernetes
The quickstart documents installing Tracee on Kubernetes with the Aqua Helm chart.Read 5 Oct 2026 · aquasecurity.github.io
Linux requirement
Tracee depends heavily on Linux and does not support other operating systems.Read 5 Oct 2026 · aquasecurity.github.io
Mac support
Tracee does not run on macOS itself; it can run inside a Linux VM, where it sees the VM rather than the Mac host.Read 5 Oct 2026 · aquasecurity.github.io
Permissions
Tracee needs non-trivial capabilities to instrument the kernel; the documentation says the easiest setup is running it as privileged or root.Read 5 Oct 2026 · aquasecurity.github.io
Security detail
Tracee documents LSM-based events as a way to cross-reference syscall events and mitigate a race condition in reading user-program information.Read 5 Oct 2026 · aquasecurity.github.io
Use cases
Listed use cases include security monitoring, compliance monitoring, troubleshooting, and forensic investigation.Read 5 Oct 2026 · aquasecurity.github.io

Plans and prices

Tracee Free Open source project · Linux only · requires compatible kernel and elevated capabilities Read 5 Oct 2026 · aquasecurity.github.io

Every Tracee plan and price →

Strong points and limits

Strong points

  • Real-time eBPF event monitoring
  • Container awareness
  • Adjustable monitoring policies
  • Kubernetes Helm deployment
  • Prometheus metrics enabled by default

Limits

  • Linux only
  • Requires compatible kernel
  • Needs elevated capabilities
  • Does not run on macOS directly

Who it suits

Tracee suits Linux operators handling runtime security, compliance, troubleshooting, or forensics. It also fits Kubernetes deployments and environments that can provide compatible kernels and elevated capabilities.

Verdict

Tracee provides Linux runtime visibility through eBPF, with deployment choices for binaries, containers, and Kubernetes. Plan for kernel compatibility and privileged access before deployment.

Where Specifiction places it

Alternatives to TraceeAll alternatives →