Tracee v0.5.0 released!

[itaysk]

Release: https://github.com/aquasecurity/tracee/releases/tag/v0.5.0

Notable changes

This release marks the beginning of Tracee's evolution from a system tracing CLI tool, to a Runtime Security solution with behavioral analysis capabilities. Tracee is now composed of multiple sub projects:

• tracee-ebpf: Same tracing CLI tool you already know, now renamed to tracee-ebpf
• libbpfgo: Go library for writing eBPF programs in Go, usable outside of Tracee as well
• tracee-rules: New rule engine to process tracee-ebpf's events and detects suspicious behavior based on built-in and user-defined "signatures".

The docker image aquasec/tracee will by default start this new runtime detection experience by loading some default signatures. The same container can still run tracee-ebpf directly, by using the "trace" sub-command of the container. See the project's Readme for a complete overview.

This is still very much a work-in-progress, as we continue to write more signatures for behavioral patterns, and to improve the usability of this new experience. Stay tuned for more updates!

• new traceable event: commit_creds
• new traceable event: switch_task_ns
• output option eof was removed from tracee-ebpf
• libbpfgo can now manipulate pinned maps (thanks @ogozman)

Notable fixes

• written files index is now relative to the our dir
• default output format for tracee-ebpf, avoids panic if ommitted

[ivanstanev]

Great choice to use Rego/OPA for the rules engine, the last thing we would need in the cloud native space is yet another rules engine similar to Falco's approach 🙂

[itaysk]

Thanks! I'm glad you like it