Tracee Versions Save

Linux Runtime Security and Forensics using eBPF

v0.20.0

3 months ago

⚡️ Release notes and discussion: https://github.com/aquasecurity/tracee/discussions/3869 ⚡️

Docker Image

docker pull docker.io/aquasec/tracee:0.20.0

Docker Images (per architecture)

docker pull docker.io/aquasec/tracee:x86_64-0.20.0
docker pull docker.io/aquasec/tracee:aarch64-0.20.0

What's Changed

docs(mkdocs): rename crs to cri in menu by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3671
Add verify-docs job by @geyslan in https://github.com/aquasecurity/tracee/pull/3672
rebase of https://github.com/aquasecurity/tracee/pull/3638 by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3683
Fix readme by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3686
chore(container): same default events as k8s deployment by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3687
fix(ebpf): use ts as fd_arg_path_map key by @geyslan in https://github.com/aquasecurity/tracee/pull/3674
fix(finding): add missing fields by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3694
refactor(engine): feed engine with signatures events by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3681
feat(signatures): add simple proctree datasource envelope by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3692
Make filtered aggregation possible by @geyslan in https://github.com/aquasecurity/tracee/pull/3677
feature(types): add packet metadata type by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3708
Packet direction flag by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3706
minor fix on top of https://github.com/aquasecurity/tracee/pull/3707 by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3709
probes: improve probes by having specific getters by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3710
feat(types): time relevant info for proctree by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3712
docs: add discussion template for adopters by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3702
Feature/proctree query time by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3691
Feature: DNS Cache datasource by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3679
chore: rename Context to EventContext by @geyslan in https://github.com/aquasecurity/tracee/pull/3716
Pin pandoc version to 3.1.2 by @geyslan in https://github.com/aquasecurity/tracee/pull/3720
libbpfgo bump to v0.6.0-libbpf-1.3 by @geyslan in https://github.com/aquasecurity/tracee/pull/3713
make https://github.com/aquasecurity/tracee/pull/3715 pass doc verification by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3721
chore(ci): bump changed-files to v40.2.0 by @geyslan in https://github.com/aquasecurity/tracee/pull/3723
bugfix(ebpf): avoid errors upon hash calc fail by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3733
fix: webhook template should support sprig funcs by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3724
feature: add ctime to containers data source by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3728
chore(release): use go1.20 for releasing by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3740
chore: fix typo by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3736
fix(release): tracee-container alpine version to 3.18 by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3744
Network: add net_tcp_connect event with DNS support by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3738
chore: refer to man pages by @geyslan in https://github.com/aquasecurity/tracee/pull/3749
feature: pluggable datasources by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3737
Bugfix/parse finding type correctly by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3760
Writeable datasource types by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3759
feature(api): add data source grpc service by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3761
chore(api): fix typo by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3762
chore(makefile): fix doube-quoted version string by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3764
feat(ebpf): optimize sendmsg/recvmsg kprobes by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3766
feature(event): create net_flow_tcp_begin event by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3750
fix(network): fix http request/response events by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3770
chore: update proto types by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3772
chore(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/3773
fix(ebpf): adjust inode struct to kernel v6.6 by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3769
feat(types): improve datasource write api by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3763
fix: filter dispatching to signatures by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3729
feature: Add name and properties to Threat, and add Threat to Event definition. by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3742
feature: writeable data source by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3725
Improve performance of exec-hash by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3752
fix: create pid file under install-path by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3775
feature: add signature name to event definition by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3743
add Struct type and detect.FindingData by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3776
Fix dynamic data arguments by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3777
chore(derive/http): change log level when packets are malformed by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3780
Types protected finding by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3782
Protected finding data by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3779
chore(deps): bump tj-actions/changed-files from 40.2.0 to 41.0.0 in /.github/workflows by @dependabot in https://github.com/aquasecurity/tracee/pull/3788
fix: use thread safe wrapper for ksyms table by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3786
fix: triggeredBy should print event on table output by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3792
fix(doc): contribution document link by @yasindce1998 in https://github.com/aquasecurity/tracee/pull/3794
Pin revive version by @geyslan in https://github.com/aquasecurity/tracee/pull/3796
fix(ebpf): fix hidden_kernel_module error in some kernels by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3797
fix(events): restore dependency in hooked_syscall by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3784
Introduce Policies versioning (map of maps) by @geyslan in https://github.com/aquasecurity/tracee/pull/3305
Update Golang in all Project by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3806
chore(docs): specify distros and versions support by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3808
Remove BPF map macros by @geyslan in https://github.com/aquasecurity/tracee/pull/3735
Fix event data structure by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3812
Fix symbol multi addrs by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3802
chore(ci): add mantic 6.6 AMIs by @geyslan in https://github.com/aquasecurity/tracee/pull/3810
fix(capture): restore absolute time in pcap frames by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3800
Update api types by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3814
feat(signatures): expose signatures helpers as Go module by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3765
chore(deps): bump github.com/containerd/containerd from 1.7.0 to 1.7.11 by @dependabot in https://github.com/aquasecurity/tracee/pull/3816
Make policies config versioned by @geyslan in https://github.com/aquasecurity/tracee/pull/3809
chore: remove replace of signatures helpers by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3819
grpc: fix nil arguments by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3823
chore: remove clang march flag by @geyslan in https://github.com/aquasecurity/tracee/pull/3831
chore: increase vb resources by @geyslan in https://github.com/aquasecurity/tracee/pull/3833
fix: skip timestamp normalizing in derived events by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3835
fix: change missing probe log level by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3836
chore(deps): bump github.com/opencontainers/runc from 1.1.7 to 1.1.12 by @dependabot in https://github.com/aquasecurity/tracee/pull/3837
Fix ArgsNum by @geyslan in https://github.com/aquasecurity/tracee/pull/3839
Fix typo in kubernetes install guide by @logicfox in https://github.com/aquasecurity/tracee/pull/3846
Various cgroup and mounting fixes and optimizations by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3829
fix(processors): change args values by name by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3838
Set exec-hash default option by @geyslan in https://github.com/aquasecurity/tracee/pull/3852
chore(k8s): prepare v0.20.0 release by @geyslan in https://github.com/aquasecurity/tracee/pull/3853

New Contributors

@yasindce1998 made their first contribution in https://github.com/aquasecurity/tracee/pull/3794
@logicfox made their first contribution in https://github.com/aquasecurity/tracee/pull/3846

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.19.0...v0.20.0

v0.19.0

6 months ago

Docker Image

docker pull docker.io/aquasec/tracee:0.19.0

Docker Images (per architecture)

docker pull docker.io/aquasec/tracee:x86_64-0.19.0
docker pull docker.io/aquasec/tracee:aarch64-0.19.0

What's Changed

Release Notes: https://github.com/aquasecurity/tracee/discussions/3670 Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.18.0-rc...v0.19.0-rc

v0.18.1

7 months ago

Docker Image

docker pull docker.io/aquasec/tracee:0.18.1

Docker Images (per architecture)

docker pull docker.io/aquasec/tracee:x86_64-0.18.1
docker pull docker.io/aquasec/tracee:aarch64-0.18.1

v0.18.0

7 months ago

Docker Image (x86_64 only)

docker pull docker.io/aquasec/tracee:0.18.0

Docker Images (per architecture)

docker pull docker.io/aquasec/tracee:x86_64-0.18.0
docker pull docker.io/aquasec/tracee:aarch64-0.18.0

What's Changed

make: set LIBBPFGO_OSRELEASE_FILE default value by @geyslan in https://github.com/aquasecurity/tracee/pull/3226
chore: migrate to golang-lru v2 by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3140
(extensions) probes: create probe group, events: start work by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3223
flags: refactor FilterMap by @yanivagman in https://github.com/aquasecurity/tracee/pull/3222
go.mod: remove types replace by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3236
containers: trim mountpoint from stored paths by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3231
docs: remove old trace subcommand by @geyslan in https://github.com/aquasecurity/tracee/pull/3238
ebpf: pipeline: reduce iteration over policies by @geyslan in https://github.com/aquasecurity/tracee/pull/3209
engine: fix panic on waitgroup by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3233
Update packaging.md for Ubuntu package building by @pimvh in https://github.com/aquasecurity/tracee/pull/3243
ebpf: fix socket_accept event by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3240
fix: fix container edge case in events pipeline by @geyslan in https://github.com/aquasecurity/tracee/pull/3253
tracee: skip golang plugin for static binaries by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3244
Fix typo in Vagrantfile's comment by @64J0 in https://github.com/aquasecurity/tracee/pull/3260
tracee: signatures-dir accept multiple values by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3246
change hooked_syscalls event so users can specify syscalls to check. by @AsafEitani in https://github.com/aquasecurity/tracee/pull/3136
events: hidden_kernel_module changes by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3255
config: extract config structs to its own pkg by @geyslan in https://github.com/aquasecurity/tracee/pull/3228
eBPF control plane signals by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3237
build: remove signing from snapshot by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3271
release: bump release tag to 0.16.0 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3272
fix: send init events to pipeline by @geyslan in https://github.com/aquasecurity/tracee/pull/3270
thread-safety issues fix by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3265
fix(pkg/events): fix tailcall dependencies race issues by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3274
build: remove release on tag push by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3273
chore: move syscaller to dist by @geyslan in https://github.com/aquasecurity/tracee/pull/3269
fix(tests): fix input paths in parsecmd test by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3275
tracee: add analyze cmd by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3101
policies: rename list fields to be plural by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3242
fix(pkg/counter): finish making counter atomic by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3276
fix: derived event not triggering if base filtered by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3280
enrich: fixes post control plane by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3285
docs: add analyze documentation by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3292
doc: add tutorial to verify tracee signature by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3291
fix: signature event not triggering if base filtered by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3281
pipeline memory efficiency using pool by @geyslan in https://github.com/aquasecurity/tracee/pull/3297
events: update syscall_pathname for security_file_open by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3298
Events and Scope flags by @geyslan in https://github.com/aquasecurity/tracee/pull/3262
pkg/containers: fix deadlock by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3311
[v0.16.0] chore: bump k8s tag to 0.16.1 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3316
docs: updating link to tracee docs for search results by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3317
feature: remove policy actions by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3314
fix(server): re-enable prometheus counters. by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3304
fix (cgroups): already dead edge case by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3325
docs: updating policies overview by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3318
chore bump 0.16.2 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3331
feature(k8s): policy k8s compatible by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3330
chore: bump k8s tag to 0.17.0 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3336
fix(ebpf): size of mntns/pidns filters key holders by @geyslan in https://github.com/aquasecurity/tracee/pull/3337
fix: validate policy names are rfc 1123 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3335
remove help command, create flags markdown docs by @geyslan in https://github.com/aquasecurity/tracee/pull/3321
fix: data source registration after NewEngine by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3342
fix(build): btfhub's bpftool in alpine container by @geyslan in https://github.com/aquasecurity/tracee/pull/3349
chore(build): add LOGFROM flag to check-pr rule by @geyslan in https://github.com/aquasecurity/tracee/pull/3348
chore(build): change check-pr output format by @geyslan in https://github.com/aquasecurity/tracee/pull/3351
refactor(events): new event definitions (mutable vs immutable data) by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3340
fix(filter): remove unneeded workaround by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3352
events: adjust hidden kernel module event to v6.4 by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3360
fix(config): loading config file by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3370
Update the URL as the old one did not lead to the grafana tutorial an… by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3371
chore(docs): add note for quote yaml value by @geyslan in https://github.com/aquasecurity/tracee/pull/3367
chore: bump k8s tags to 0.17.1 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3374
bugfix(capture): remove CONFIG_KALLSYMS_ALL dependency by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3381
docs: additional resources for the docs by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3379
feat: add tracee rpc service by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3389
feat: add loggers atomic level by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3391
Add grpc server by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3390
--help flag parsing by @geyslan in https://github.com/aquasecurity/tracee/pull/3393
feat: add diagnostic rpc by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3395
Add grpc diagnostic by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3394
fix: k8s policies tutorial by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3373
chore(flags): change scope/event flag parsers by @geyslan in https://github.com/aquasecurity/tracee/pull/3343
fix: log level should match zap log priority by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3409
fix: ignore error for cgroups that doesn't exist by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3410
refactor: getStackAddresses doesn't return an err by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3414
chore(revive): mitigate redundant warning by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3417
fix: committing typo by @testwill in https://github.com/aquasecurity/tracee/pull/3418
feature(types): add task identifier by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3425
fix(flags): use scope flag parser for policy by @geyslan in https://github.com/aquasecurity/tracee/pull/3429
fix: capture of writev by @roikol in https://github.com/aquasecurity/tracee/pull/3413
fix: fix section name for vfs_readv by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3421
feat: filter file capture by ELF type by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3361
docs: modifying readme by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3378
Fix(capture): fix verifier issue with elf capture by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3433
fix: print_mem_dump fails on missing symbol by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3384
Revert "fix: print_mem_dump fails on missing symbol (#3384)" by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3436
fix(definitions): ksymbols dependencies handled wrongly by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3443
feat: add streams by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3411
Add definition proto by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3447
feat: add argv to security_bprm_check by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3442
Fix closed chan read 2 by @geyslan in https://github.com/aquasecurity/tracee/pull/3438
feat: add version proto by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3459
feat: add version and description to definition by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3437
Add enable/disable rule by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3431
build(deps): bump github.com/cyphar/filepath-securejoin from 0.2.3 to 0.2.4 by @dependabot in https://github.com/aquasecurity/tracee/pull/3452
Update Readme.md by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3434
chore(revive): disable unchecked-type-assertion by @geyslan in https://github.com/aquasecurity/tracee/pull/3474
Rename !container and binary scope filters by @geyslan in https://github.com/aquasecurity/tracee/pull/3451
Add definition grpc endpoint by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3450
feat: add enable/disable event rpc by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3467
docs: adding guidelines on contributing to the documentation by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3415
docs: changes to the policies documentation by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3416
feature(proctree): Introduce a process tree by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3364
chore(libbpfgo): bump to v0.5.0-libbpf-1.2 by @geyslan in https://github.com/aquasecurity/tracee/pull/3482
chore(ebpf): not fail if some ksymbol is not found by @geyslan in https://github.com/aquasecurity/tracee/pull/3476
chore(tests): comment out init sighup test by @geyslan in https://github.com/aquasecurity/tracee/pull/3483
fix: remove params from event definition proto by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3485
feat: add event enable/disable by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3466
feat: add enable/disable event grpc endpoint by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3487
feat: Add new event structure by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3465
fix: regenerate definition.pb.go by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3490
feat: add StreamEvents rpc by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3491
fix: GetEventDefinition doesn't have params by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3492
fix: rename policy apiVersion and kind by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3484
fix(proctree): include thread group leader in threads LRU map by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3494
fix(ebpf): fix symbol name on error by @geyslan in https://github.com/aquasecurity/tracee/pull/3497
fix: stackaddress needs to have symbol name by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3499
Revert "fix(ebpf): fix symbol name on error" by @geyslan in https://github.com/aquasecurity/tracee/pull/3501
feat: add event_data to event proto by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3496
Add streams endpoint by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3493
fix(packaging): adjust ubuntu and fedora packaging by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3502
fix(ebpf): triggerMemDump check all filters by @geyslan in https://github.com/aquasecurity/tracee/pull/3504
Types change for #3503 by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3506
events: add ftrace_hook event by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3412
fix: fix uint and string types by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3507
feat(event): export thread, process and parent entity id by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3503
feat(types): add proctree datasource by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3509
fix: make types uniform with wrappers by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3512
fix: fix tactic, and int32_array names by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3514
Chore build by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3513
Log probe attachment error, continue running by @geyslan in https://github.com/aquasecurity/tracee/pull/3495
fix: convert []trace.Argument into map<string,EventData> by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3510
fix: link cosign tutorial to mkdocs.yml by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3515
fix(proctree): allow regular events to create proctree nodes by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3498
docs: Fix incorrect flags and usage documentation for unlinkat by @kdrag0n in https://github.com/aquasecurity/tracee/pull/3306
chore(vagrant): add support to arm64 architecture by @geyslan in https://github.com/aquasecurity/tracee/pull/3464
fix(Vagrantfile): wrong var reference by @geyslan in https://github.com/aquasecurity/tracee/pull/3523
docs: running tracee docker container on amd64 and arm64 by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3456
feat(proctree): create process tree data source by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3522
feat(types): add executable to event by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3524
docs(contributing): update vagrant hypervisor info by @geyslan in https://github.com/aquasecurity/tracee/pull/3525
feature(proctree): enrich events with executable from proctree by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3526
chore(k8s): bump k8s tag to v0.18.0 by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3527

New Contributors

@pimvh made their first contribution in https://github.com/aquasecurity/tracee/pull/3243
@64J0 made their first contribution in https://github.com/aquasecurity/tracee/pull/3260
@testwill made their first contribution in https://github.com/aquasecurity/tracee/pull/3418
@kdrag0n made their first contribution in https://github.com/aquasecurity/tracee/pull/3306

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.15.1...v0.18.0

v0.17.1

9 months ago

Docker Image (x86_64 only)

docker pull docker.io/aquasec/tracee:0.17.1

Docker Images (per architecture)

docker pull docker.io/aquasec/tracee:x86_64-0.17.1
docker pull docker.io/aquasec/tracee:aarch64-0.17.1

v0.17.0

9 months ago

Docker Image (x86_64 only)

docker pull docker.io/aquasec/tracee:0.17.0

Docker Images (per architecture)

docker pull docker.io/aquasec/tracee:x86_64-0.17.0
docker pull docker.io/aquasec/tracee:aarch64-0.17.0

v0.16.2

10 months ago

Docker Image (x86_64 only)

docker pull docker.io/aquasec/tracee:0.16.2

Docker Images (per architecture)

docker pull docker.io/aquasec/tracee:x86_64-0.16.2
docker pull docker.io/aquasec/tracee:aarch64-0.16.2

What's Changed

[v0.16.0] backport: dead cgroups fix by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3326

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.16.1...v0.16.2

v0.16.1

10 months ago

Docker Image (x86_64 only)

docker pull docker.io/aquasec/tracee:0.16.1

Docker Images (per architecture)

docker pull docker.io/aquasec/tracee:x86_64-0.16.1
docker pull docker.io/aquasec/tracee:aarch64-0.16.1

What's Changed

pkg/containers: fix deadlock @josedonizetti in https://github.com/aquasecurity/tracee/pull/3311

v0.16.0

10 months ago

Docker Image (x86_64 only)

docker pull docker.io/aquasec/tracee:0.16.0

Docker Images (per architecture)

docker pull docker.io/aquasec/tracee:x86_64-0.16.0
docker pull docker.io/aquasec/tracee:aarch64-0.16.0

What's Changed

make: set LIBBPFGO_OSRELEASE_FILE default value by @geyslan in https://github.com/aquasecurity/tracee/pull/3226
chore: migrate to golang-lru v2 by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3140
(extensions) probes: create probe group, events: start work by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3223
flags: refactor FilterMap by @yanivagman in https://github.com/aquasecurity/tracee/pull/3222
go.mod: remove types replace by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3236
containers: trim mountpoint from stored paths by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3231
docs: remove old trace subcommand by @geyslan in https://github.com/aquasecurity/tracee/pull/3238
ebpf: pipeline: reduce iteration over policies by @geyslan in https://github.com/aquasecurity/tracee/pull/3209
engine: fix panic on waitgroup by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3233
Update packaging.md for Ubuntu package building by @pimvh in https://github.com/aquasecurity/tracee/pull/3243
ebpf: fix socket_accept event by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3240
fix: fix container edge case in events pipeline by @geyslan in https://github.com/aquasecurity/tracee/pull/3253
tracee: skip golang plugin for static binaries by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3244
Fix typo in Vagrantfile's comment by @64J0 in https://github.com/aquasecurity/tracee/pull/3260
tracee: signatures-dir accept multiple values by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3246
change hooked_syscalls event so users can specify syscalls to check. by @AsafEitani in https://github.com/aquasecurity/tracee/pull/3136
events: hidden_kernel_module changes by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3255
config: extract config structs to its own pkg by @geyslan in https://github.com/aquasecurity/tracee/pull/3228
eBPF control plane signals by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3237
build: remove signing from snapshot by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3271
release: bump release tag to 0.16.0 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3272
fix: send init events to pipeline by @geyslan in https://github.com/aquasecurity/tracee/pull/3270
thread-safety issues fix by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3265
fix(pkg/events): fix tailcall dependencies race issues by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3274
build: remove release on tag push by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3273
chore: move syscaller to dist by @geyslan in https://github.com/aquasecurity/tracee/pull/3269
fix(tests): fix input paths in parsecmd test by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3275
tracee: add analyze cmd by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3101
policies: rename list fields to be plural by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3242
[v0.16.0] fix(pkg/counter): finish making counter atomic (#3276) by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3284
[v0.16.0] fix: derived event not triggering if base filtered by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3287
[v0.16.0] fix: enrich post control plane (#3285) by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3289

New Contributors

@pimvh made their first contribution in https://github.com/aquasecurity/tracee/pull/3243
@64J0 made their first contribution in https://github.com/aquasecurity/tracee/pull/3260

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.15.1...v0.16.0

v0.15.1

11 months ago

Docker Image (x86_64 only)

docker pull docker.io/aquasec/tracee:0.15.1

Docker Images (per architecture)

docker pull docker.io/aquasec/tracee:x86_64-0.15.1
docker pull docker.io/aquasec/tracee:aarch64-0.15.1

What's Changed

workflow: fix cosign signing by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3212
make integration tests more robust by @geyslan in https://github.com/aquasecurity/tracee/pull/2688
tests: fix event MatchedPoliciesUser check by @geyslan in https://github.com/aquasecurity/tracee/pull/3220
vagrant: clean up/fix provisioning script by @geyslan in https://github.com/aquasecurity/tracee/pull/3216
Create SECURITY.md by @itaysk in https://github.com/aquasecurity/tracee/pull/3221
ebpf: fix mem_prot_alert anonymous file info by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3225
makefile: add check-pr rule by @geyslan in https://github.com/aquasecurity/tracee/pull/3215
tracee: fix panic when ctrl-c after the boot by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3188
k8s: bump release tag to 0.15.1 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3232

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.15.0...v0.15.1