Tracee is an open-source Linux runtime security and forensics project that uses eBPF to observe system and application behavior. Its event model, policies and rule mechanisms can help security teams investigate activity that is difficult to understand from static configuration or vulnerability scans alone.
This guide explains the project architecture, prerequisites, event selection, policy scope, output formats, Kubernetes deployment considerations and operational limits. It also discusses performance, least-privilege deployment and how to use runtime telemetry as one component of a broader detection and response program.
This page provides a concise English summary. The full long-form analysis is currently available in Persian.
