{"id":13414473,"url":"https://github.com/aquasecurity/tracee","last_synced_at":"2026-10-19T00:09:19.364Z","repository":{"id":37285339,"uuid":"209313689","full_name":"aquasecurity/tracee","owner":"aquasecurity","description":"Linux Runtime Security and Forensics using eBPF","archived":false,"fork":false,"pushed_at":"2026-10-01T12:40:47.000Z","size":211174,"stargazers_count":4632,"open_issues_count":125,"forks_count":512,"subscribers_count":56,"default_branch":"main","last_synced_at":"2026-10-04T10:54:30.531Z","etag":null,"topics":["bpf","docker","ebpf","golang","kubernetes","linux","runtime-security","security"],"latest_commit_sha":null,"homepage":"https://aquasecurity.github.io/tracee/latest","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aquasecurity.png","metadata":{"files":{"readme":"Readme.md","changelog":null,"contributing":"docs/contributing/adding-events.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":".cursor/rules/commit-pr-conventions.mdc","copilot":".github/copilot-instructions.md","dco":null,"cla":null,"disclosure":null}},"created_at":"2019-09-18T13:20:17.000Z","updated_at":"2026-10-04T00:03:00.000Z","dependencies_parsed_at":"2023-10-03T02:15:19.813Z","dependency_job_id":"f3de5596-0ee1-4a03-94c0-1f38989a6883","html_url":"https://github.com/aquasecurity/tracee","commit_stats":{"total_commits":2076,"total_committers":78,"mean_commits":"26.615384615384617","dds":0.7967244701348748,"last_synced_commit":"2de14ea130db3e76b031218e273187978a4b6eb1"},"previous_names":[],"tags_count":92,"template":false,"template_full_name":null,"purl":"pkg:github/aquasecurity/tracee","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Ftracee","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Ftracee/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Ftracee/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Ftracee/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aquasecurity","download_url":"https://codeload.github.com/aquasecurity/tracee/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Ftracee/sbom","scorecard":{"id":97652,"data":{"date":"2025-08-11","repo":{"name":"github.com/aquasecurity/tracee","commit":"0a9ab353c692d9e1559a47050adce07561621de2"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":6.2,"checks":[{"name":"Security-Policy","score":4,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Warn: no linked content found","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Code-Review","score":8,"reason":"Found 21/25 approved changesets -- score normalized to 8","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'packages' permission set to 'read': .github/workflows/codeql.yaml:22","Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yaml:23","Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yaml:24","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/fast-forward.yaml:13","Info: jobLevel 'contents' permission set to 'read': .github/workflows/labeler.yml:11","Info: jobLevel 'contents' permission set to 'read': .github/workflows/pr-ff.yaml:10","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release-snapshot.yaml:64","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release-snapshot.yaml:106","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release-snapshot.yaml:21","Info: jobLevel 'contents' permission set to 'read': .github/workflows/release.yaml:107","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yaml:21","Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yaml:66","Warn: no topLevel permission defined: .github/workflows/codeql.yaml:1","Warn: no topLevel permission defined: .github/workflows/fast-forward.yaml:1","Warn: no topLevel permission defined: .github/workflows/labeler.yml:1","Warn: no topLevel permission defined: .github/workflows/mkdocs-dev.yaml:1","Warn: no topLevel permission defined: .github/workflows/mkdocs-latest.yaml:1","Warn: no topLevel permission defined: .github/workflows/pr-ff.yaml:1","Warn: no topLevel permission defined: .github/workflows/pr-sync.yaml:1","Warn: no topLevel permission defined: .github/workflows/pr.yaml:1","Warn: no topLevel permission defined: .github/workflows/publish-helm.yaml:1","Warn: no topLevel permission defined: .github/workflows/release-snapshot.yaml:1","Warn: no topLevel permission defined: .github/workflows/release.yaml:1","Warn: no topLevel permission defined: .github/workflows/test-daily.yaml:1","Warn: no topLevel permission defined: .github/workflows/test-helm-chart.yaml:1"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":5,"reason":"branch protection is not maximal on development and all release branches","details":["Info: 'allow deletion' disabled on branch 'main'","Info: 'force pushes' disabled on branch 'main'","Warn: 'branch protection settings apply to administrators' is disabled on branch 'main'","Warn: 'stale review dismissal' is disabled on branch 'main'","Warn: required approving review count is 1 on branch 'main'","Warn: codeowners review is not required on branch 'main'","Warn: 'last push approval' is disabled on branch 'main'","Warn: no status checks found to merge onto branch 'main'","Info: PRs are required in order to make changes on branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v0.23.2 not signed: https://api.github.com/repos/aquasecurity/tracee/releases/233535791","Warn: release artifact v0.23.1 not signed: https://api.github.com/repos/aquasecurity/tracee/releases/209736636","Warn: release artifact v0.23.0 not signed: https://api.github.com/repos/aquasecurity/tracee/releases/201211862","Warn: release artifact v0.22.6 not signed: https://api.github.com/repos/aquasecurity/tracee/releases/201153245","Warn: release artifact v0.22.5 not signed: https://api.github.com/repos/aquasecurity/tracee/releases/190011210","Warn: release artifact v0.23.2 does not have provenance: https://api.github.com/repos/aquasecurity/tracee/releases/233535791","Warn: release artifact v0.23.1 does not have provenance: https://api.github.com/repos/aquasecurity/tracee/releases/209736636","Warn: release artifact v0.23.0 does not have provenance: https://api.github.com/repos/aquasecurity/tracee/releases/201211862","Warn: release artifact v0.22.6 does not have provenance: https://api.github.com/repos/aquasecurity/tracee/releases/201153245","Warn: release artifact v0.22.5 does not have provenance: https://api.github.com/repos/aquasecurity/tracee/releases/190011210"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/release-snapshot.yaml:15"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"SAST","score":10,"reason":"SAST tool is run on all commits","details":["Info: SAST configuration detected: CodeQL","Info: all commits (30) are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":7,"reason":"3 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GO-2025-3787 / GHSA-fv92-fjc5-jj9h","Warn: Project is vulnerable to: GO-2025-3829","Warn: Project is vulnerable to: GO-2025-3488 / GHSA-6v2p-p543-phr9"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Pinned-Dependencies","score":5,"reason":"dependency not pinned by hash detected -- score normalized to 5","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yaml:60: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/tracee/codeql.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql.yaml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/tracee/codeql.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-snapshot.yaml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/tracee/release-snapshot.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-snapshot.yaml:86: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/tracee/release-snapshot.yaml/main?enable=pin","Warn: containerImage not pinned by hash: builder/Dockerfile.alpine-tracee-container:19","Warn: containerImage not pinned by hash: builder/Dockerfile.alpine-tracee-container:35","Warn: containerImage not pinned by hash: builder/Dockerfile.alpine-tracee-container:108","Warn: containerImage not pinned by hash: builder/Dockerfile.alpine-tracee-container:132","Warn: containerImage not pinned by hash: builder/Dockerfile.alpine-tracee-container:155","Warn: containerImage not pinned by hash: builder/Dockerfile.alpine-tracee-make:7","Warn: containerImage not pinned by hash: builder/Dockerfile.alpine-tracee-make:51","Warn: containerImage not pinned by hash: builder/Dockerfile.alpine-tracee-make:77","Warn: containerImage not pinned by hash: builder/Dockerfile.alpine-tracee-make:110","Warn: containerImage not pinned by hash: builder/Dockerfile.k8s:1: pin your Docker image by updating golang:1.24.3 to golang:1.24.3@sha256:81bf5927dc91aefb42e2bc3a5abdbe9bb3bae8ba8b107e2a4cf43ce3402534c6","Warn: containerImage not pinned by hash: builder/Dockerfile.man:1: pin your Docker image by updating ubuntu to ubuntu@sha256:7c06e91f61fa88c08cc74f7e1b7c69ae24910d745357e0dfe1d2c0322aaf20f9","Warn: containerImage not pinned by hash: builder/Dockerfile.mkdocs:1: pin your Docker image by updating squidfunk/mkdocs-material:9.6.13 to squidfunk/mkdocs-material:9.6.13@sha256:f6c81d538499f5755c8d1486f0abcda50bb631be391890ef823fcba18803114a","Warn: containerImage not pinned by hash: builder/Dockerfile.protoc:1: pin your Docker image by updating golang:1.24.3 to golang:1.24.3@sha256:81bf5927dc91aefb42e2bc3a5abdbe9bb3bae8ba8b107e2a4cf43ce3402534c6","Warn: containerImage not pinned by hash: builder/Dockerfile.ubuntu-tracee-make:5: pin your Docker image by updating ubuntu:jammy to ubuntu:jammy@sha256:1aa979d85661c488ce030ac292876cf6ed04535d3a237e49f61542d8e5de5ae0","Warn: goCommand not pinned by hash: builder/Dockerfile.alpine-tracee-make:68-71","Warn: pipCommand not pinned by hash: builder/Dockerfile.mkdocs:3-5","Warn: pipCommand not pinned by hash: builder/Dockerfile.mkdocs:3-5","Warn: pipCommand not pinned by hash: builder/Dockerfile.mkdocs:3-5","Warn: goCommand not pinned by hash: builder/Dockerfile.ubuntu-tracee-make:79-81","Warn: goCommand not pinned by hash: tests/libbpfgo.sh:23","Warn: pipCommand not pinned by hash: .github/workflows/mkdocs-dev.yaml:28","Warn: pipCommand not pinned by hash: .github/workflows/mkdocs-dev.yaml:29","Warn: pipCommand not pinned by hash: .github/workflows/mkdocs-dev.yaml:30","Warn: pipCommand not pinned by hash: .github/workflows/mkdocs-latest.yaml:32","Warn: pipCommand not pinned by hash: .github/workflows/mkdocs-latest.yaml:33","Warn: pipCommand not pinned by hash: .github/workflows/mkdocs-latest.yaml:34","Info:  26 out of  28 GitHub-owned GitHubAction dependencies pinned","Info:  20 out of  22 third-party GitHubAction dependencies pinned","Info:   0 out of  14 containerImage dependencies pinned","Info:  10 out of  13 goCommand dependencies pinned","Info:   0 out of   9 pipCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}}]},"last_synced_at":"2025-08-15T09:24:38.501Z","repository_id":37285339,"created_at":"2025-08-15T09:24:38.502Z","updated_at":"2025-08-15T09:24:38.502Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344872684,"owners_count":38343428,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-18T02:00:06.448Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bpf","docker","ebpf","golang","kubernetes","linux","runtime-security","security"],"created_at":"2024-07-30T21:00:22.821Z","updated_at":"2026-10-19T00:09:16.348Z","avatar_url":"https://github.com/aquasecurity.png","language":"Go","funding_links":[],"categories":["Go","Official resources Tracee","Projects Related to eBPF","Forensics Tools","C","Dependency intelligence","Kubernetes","Security","Container \u0026 Kubernetes Security","golang","Go (531)","Other Lists","security","eBPF 相关项目","Tools","Container Security","Container and Kubernetes Security"],"sub_categories":["Security","Kubernetes runtime security","Kubernetes Security","Runtime Security","🧪 LAB","安全","Detection"],"readme":"![Tracee Logo](docs/images/tracee.png)\n\n\u003c!-- links that differ between docs and readme --\u003e\n[installation]:https://aquasecurity.github.io/tracee/latest/docs/install/\n[docker-guide]:https://aquasecurity.github.io/tracee/latest/docs/install/docker/\n[kubernetes-guide]:https://aquasecurity.github.io/tracee/latest/docs/install/kubernetes/\n[prereqs]:https://aquasecurity.github.io/tracee/latest/docs/install/prerequisites/\n[macfaq]:https://aquasecurity.github.io/tracee/latest/docs/advanced/mac/\n\nBefore moving on, please consider giving us a GitHub star ⭐️. Thank you!\n\n## About Tracee\n\nTracee is a runtime security and observability tool that helps you understand how your system and applications behave.  \nIt is using [eBPF technology](https://ebpf.io/what-is-ebpf/) to tap into your system and expose that information as events that you can consume.  \nEvents range from factual system activity events to sophisticated security events that detect suspicious behavioral patterns.\n\nTo learn more about Tracee, check out the [documentation](https://aquasecurity.github.io/tracee/).\n\n## Quickstart\n\nTo quickly try Tracee use one of the following snippets. For a more complete installation guide, check out the [Installation section][installation].  \nTracee should run on most common Linux distributions and kernels. For compatibility information see the [Prerequisites][prereqs] page.  Mac users, please read [this FAQ][macfaq].\n\n### Using Docker\n\n```shell\ndocker run --name tracee -it --rm \\\n  --pid=host --cgroupns=host --privileged \\\n  -v /etc/os-release:/etc/os-release-host:ro \\\n  -v /var/run:/var/run:ro \\\n  aquasec/tracee:latest\n```\n\nFor a complete walkthrough please see the [Docker getting started guide][docker-guide].\n\n### On Kubernetes\n\n```shell\nhelm repo add aqua https://aquasecurity.github.io/helm-charts/\nhelm repo update\nhelm install tracee aqua/tracee --namespace tracee --create-namespace\n```\n\n```shell\nkubectl logs --follow --namespace tracee daemonset/tracee\n```\n\nFor a complete walkthrough please see the [Kubernetes getting started guide][kubernetes-guide].\n\n## Contributing\n  \nJoin the community, and talk to us about any matter in the [GitHub Discussions](https://github.com/aquasecurity/tracee/discussions) or [Slack](https://slack.aquasec.com).  \nIf you run into any trouble using Tracee or you would like to give use user feedback, please [create an issue.](https://github.com/aquasecurity/tracee/issues)\n\nFind more information on [contribution documentation](https://aquasecurity.github.io/tracee/latest/contributing/overview/).\n\n## More about Aqua Security\n\nTracee is an [Aqua Security](https://aquasec.com) open source project.  \nLearn about our open source work and portfolio [here](https://www.aquasec.com/products/open-source-projects/).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faquasecurity%2Ftracee","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faquasecurity%2Ftracee","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faquasecurity%2Ftracee/lists"}