tracee

Docker Image

• docker pull docker.io/aquasec/tracee:0.22.1

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.22.1
• docker pull docker.io/aquasec/tracee:aarch64-0.22.1

⚡️ Release notes and discussion: https://github.com/aquasecurity/tracee/discussions/4272 ⚡️

Docker Image

• docker pull docker.io/aquasec/tracee:0.22.0

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.22.0
• docker pull docker.io/aquasec/tracee:aarch64-0.22.0

What's Changed

• Fix release action by @geyslan in https://github.com/aquasecurity/tracee/pull/4136
• fix(ci): dev tag is the latest snapshot by @geyslan in https://github.com/aquasecurity/tracee/pull/4137
• chore(ci): use dev tag for docker image building by @geyslan in https://github.com/aquasecurity/tracee/pull/4138
• chore: install last version of golang by @rscampos in https://github.com/aquasecurity/tracee/pull/4139
• chore: golang binary move to tmp by @rscampos in https://github.com/aquasecurity/tracee/pull/4140
• fix(ci): make release rule to have prerequisites by @geyslan in https://github.com/aquasecurity/tracee/pull/4141
• Create Makefile format-pr rule by @geyslan in https://github.com/aquasecurity/tracee/pull/4142
• Bumps to fix cve-2024-24790 by @geyslan in https://github.com/aquasecurity/tracee/pull/4143
• fix(build): mv gh release logic to release rule by @geyslan in https://github.com/aquasecurity/tracee/pull/4145
• feat(events): add security_task_setrlimit by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4148
• fix(build): fix release build by @geyslan in https://github.com/aquasecurity/tracee/pull/4150
• Added event containing full payload for all packets by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4122
• Fix Integration Tests by @geyslan in https://github.com/aquasecurity/tracee/pull/4157
• chore(logger): safe guard before locking by @geyslan in https://github.com/aquasecurity/tracee/pull/4160
• chore: rem logger and errfmt as deps from env pkg by @geyslan in https://github.com/aquasecurity/tracee/pull/4129
• chore: make dependencies manager a singleton by @geyslan in https://github.com/aquasecurity/tracee/pull/4161
• fix: generic kubernetes containerd path pattern by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4155
• Tidying Policy Manager by @geyslan in https://github.com/aquasecurity/tracee/pull/4165
• fix(events): ftrace_hook: address tabs in input lines by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4110
• fix(pipeline): add ebpf caps in stack addres query by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4169
• fix(tests): remove named pipe if it exists by @geyslan in https://github.com/aquasecurity/tracee/pull/4171
• feat(events): create tracee_info event by @rscampos in https://github.com/aquasecurity/tracee/pull/4166
• Fix deps deadlock by @geyslan in https://github.com/aquasecurity/tracee/pull/4173
• Policies tidying more by @geyslan in https://github.com/aquasecurity/tracee/pull/4168
• Caps concurrency fix by @geyslan in https://github.com/aquasecurity/tracee/pull/4175
• Fix(events): don't remove fork excess args by @rscampos in https://github.com/aquasecurity/tracee/pull/4167
• fix(proctree): fix clock type differences by @rscampos in https://github.com/aquasecurity/tracee/pull/4117
• feat(caps): base ebpf capabilities by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4178
• chore(deps): bump google.golang.org/grpc from 1.64.0 to 1.64.1 by @dependabot in https://github.com/aquasecurity/tracee/pull/4180
• Packet capture context by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4072
• chore: introduce eventFlags to policy manager by @geyslan in https://github.com/aquasecurity/tracee/pull/4179
• chore(cap): check if cap is supported before set/unset by @rscampos in https://github.com/aquasecurity/tracee/pull/4185
• fix(build): add the include to 3rdparty libbpf during libbpfgo compilation by @rscampos in https://github.com/aquasecurity/tracee/pull/4186
• chore(build): trigger tracee tests on Makefile changes by @rscampos in https://github.com/aquasecurity/tracee/pull/4187
• chore: use libbpfgo to check bpf helper func by @rscampos in https://github.com/aquasecurity/tracee/pull/4184
• chore(deps): bump google.golang.org/grpc from 1.64.0 to 1.64.1 in /api by @dependabot in https://github.com/aquasecurity/tracee/pull/4188
• fix: inner error inside check for ebpf func by @rscampos in https://github.com/aquasecurity/tracee/pull/4189
• feat(ebpf): configurable pipeline channel size by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4182
• chore(ebpf): optimize filldir64 program by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4183
• fix(controlplane): filter unnecessary enriches by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4193
• feat(ebpf): add security_settime64 by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4201
• fix: Ensure correct event dependency for process_execute_failed by @yanivagman in https://github.com/aquasecurity/tracee/pull/4203
• fix: Prevent loading syscall-specific BPF programs for non-syscall events by @yanivagman in https://github.com/aquasecurity/tracee/pull/4202
• feat(ebpf): add prev_comm for sched_process_exec by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4206
• chore: release bpf object memory by @rscampos in https://github.com/aquasecurity/tracee/pull/4209
• chore(deps): bump github.com/docker/docker from 26.1.3+incompatible to 26.1.4+incompatible by @dependabot in https://github.com/aquasecurity/tracee/pull/4215
• fix: necessary to Init engine before Start by @rscampos in https://github.com/aquasecurity/tracee/pull/4222
• fix: TRACE_RET_FUNC macro by @yanivagman in https://github.com/aquasecurity/tracee/pull/4216
• chore(parsers): optimize ParseMmapProt by @geyslan in https://github.com/aquasecurity/tracee/pull/4200
• improve flag parsing performance by @geyslan in https://github.com/aquasecurity/tracee/pull/4197
• fix: set engine to nil - sig benchmark by @rscampos in https://github.com/aquasecurity/tracee/pull/4234
• chore(sig): define signature metadata statically by @rscampos in https://github.com/aquasecurity/tracee/pull/4237
• chore(deps): bump github.com/docker/docker from 26.1.4+incompatible to 26.1.5+incompatible by @dependabot in https://github.com/aquasecurity/tracee/pull/4240
• feat(ebpf): use bpf_task_pt_regs when available by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4238
• feat: add syscall helper macros by @yanivagman in https://github.com/aquasecurity/tracee/pull/4243
• feat(ebpf): make security_socket_setsockopt not rely on sys_enter/exit by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4224
• remove e2e tests for kernels 5.4 and 4.18 on ARM by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4247
• fix(ebpf): use correct syscall id for compat by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4245
• feat(ebpf): make security_file_open not rely on sys_enter/exit by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4226
• feat(ebpf): remove sys_enter/exit dependency from security_socket_con… by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4220
• feat(ebpf): make security_socket_accept not rely on sys_enter/exit by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4213
• feat(ebpf): make mem_prot_alert not rely on sys_enter/exit by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4227
• feat(ebpf): make security_socket_bind not rely on sys_enter/exit by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4225
• feat(ebpf): make set_fs_pwd not rely on sys_enter/exit by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4228
• chore: pin go tools versions by @geyslan in https://github.com/aquasecurity/tracee/pull/4251
• perf: benchmark improve sig GetMetadata by @rscampos in https://github.com/aquasecurity/tracee/pull/4223
• chore: update AMI matrix images by @rscampos in https://github.com/aquasecurity/tracee/pull/4250
• Improve save_args_to_submit_buf by @geyslan in https://github.com/aquasecurity/tracee/pull/4217
• feat(ebpf): add path&ctime to module_load event by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4235
• fix(ebpf): fix compilation warning sockfd_addr by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4254
• process_execute_failed: don't rely on sys_enter by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4259
• Generic syscall kprobes by @yanivagman in https://github.com/aquasecurity/tracee/pull/4256
• Proctree improvements (RSS/Performance) by @geyslan in https://github.com/aquasecurity/tracee/pull/4261
• optimize parser options check by @geyslan in https://github.com/aquasecurity/tracee/pull/4199
• Changelog optimization by @geyslan in https://github.com/aquasecurity/tracee/pull/4242
• fix: improve performance of readStringVarFromBuff by @geyslan in https://github.com/aquasecurity/tracee/pull/4194
• improve flag parsing performance continuation by @geyslan in https://github.com/aquasecurity/tracee/pull/4198
• fix(build): parallel build (libbpf wise) by @geyslan in https://github.com/aquasecurity/tracee/pull/4196
• Provide manual files in release image/archive by @geyslan in https://github.com/aquasecurity/tracee/pull/4230
• fix(build): cyclic dependency in makefile by @geyslan in https://github.com/aquasecurity/tracee/pull/4262
• chore: remove leftover from #4262 by @geyslan in https://github.com/aquasecurity/tracee/pull/4265
• chore(k8s): prepare v0.22.0 release by @rscampos in https://github.com/aquasecurity/tracee/pull/4267

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.21.0...v0.22.0

⚡️ Release notes and discussion: https://github.com/aquasecurity/tracee/discussions/4147 ⚡️

Docker Image

• docker pull docker.io/aquasec/tracee:0.21.0

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.21.0
• docker pull docker.io/aquasec/tracee:aarch64-0.21.0

What's Changed

• fix: e2e-net-tests should use unified binary by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3842
• Docs: fixed the typo by @Tej-Singh-Rana in https://github.com/aquasecurity/tracee/pull/3859
• GitHub actions chore by @geyslan in https://github.com/aquasecurity/tracee/pull/3864
• chore: remove gob printer by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3841
• feat: allow webhook configuration via helm values by @ndegory in https://github.com/aquasecurity/tracee/pull/3832
• grpc: add direction to packet metadata by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3861
• grpc: update packet metadata by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3862
• chore: bump opa to 0.61.0 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3868
• Use EXECUTION_TYPE label for github self host runner by @sharon-amir in https://github.com/aquasecurity/tracee/pull/3875
• fix(tests): unattended upgrades still running sometimes by @geyslan in https://github.com/aquasecurity/tracee/pull/3877
• fix(docs): kubectl configmap command by @geyslan in https://github.com/aquasecurity/tracee/pull/3880
• fix: bump opa to v0.61.0 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3887
• chore: add labels for grpc and api by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3890
• fix(ebpf): fix hidden_kernel_module not found symbol by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3834
• fix: improve performance of magic_write event by @yanivagman in https://github.com/aquasecurity/tracee/pull/3899
• fix(derive): keep symbols_collision state between events by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3894
• helm: config go template only if passed by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3884
• ebpf: don't send magic_write with zero bytes by @yanivagman in https://github.com/aquasecurity/tracee/pull/3901
• fix(events): fix ftrace_hook by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3896
• chore: change github run id format by @geyslan in https://github.com/aquasecurity/tracee/pull/3902
• fix(tests): e2e-install-deps.sh wait for unlock by @geyslan in https://github.com/aquasecurity/tracee/pull/3910
• Fix proc info lru by @yanivagman in https://github.com/aquasecurity/tracee/pull/3918
• chore: use map instead of stack to store task_info by @yanivagman in https://github.com/aquasecurity/tracee/pull/3920
• Improve bpf policies config access by @geyslan in https://github.com/aquasecurity/tracee/pull/3906
• Change inotify_watch event to security_path_notify by @oshaked1 in https://github.com/aquasecurity/tracee/pull/3913
• chore(deps): bump github.com/docker/docker from 24.0.7+incompatible to 24.0.9+incompatible by @dependabot in https://github.com/aquasecurity/tracee/pull/3925
• Concurrency issue at analyze by @rscampos in https://github.com/aquasecurity/tracee/pull/3907
• Optimize init program by @yanivagman in https://github.com/aquasecurity/tracee/pull/3923
• refactor: move to the new pyroscope package by @06kellyjac in https://github.com/aquasecurity/tracee/pull/3927
• fix: make check-pr compliant with different shells by @geyslan in https://github.com/aquasecurity/tracee/pull/3929
• chore: ensure unattended-upgrades killing by @geyslan in https://github.com/aquasecurity/tracee/pull/3934
• chore!: remove gob support from tracee-rules by @geyslan in https://github.com/aquasecurity/tracee/pull/3939
• fix(filters): handle syscall arg by @geyslan in https://github.com/aquasecurity/tracee/pull/3893
• fix: preallocate ids for signatures upon load by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3941
• chore(deps): bump google.golang.org/protobuf to v1.33.0 by @hangrymuppet in https://github.com/aquasecurity/tracee/pull/3946
• fix: security_socket_connect wrong fd by @yanivagman in https://github.com/aquasecurity/tracee/pull/3951
• Invert Policies inner maps key pair by @geyslan in https://github.com/aquasecurity/tracee/pull/3955
• Opa bump by @geyslan in https://github.com/aquasecurity/tracee/pull/3957
• chore: set xtrace on e2e-install-deps.sh script by @geyslan in https://github.com/aquasecurity/tracee/pull/3958
• Add ArgVal signature helper by @oshaked1 in https://github.com/aquasecurity/tracee/pull/3954
• chore(policy): add policiesMapByName to Policies by @geyslan in https://github.com/aquasecurity/tracee/pull/3956
• Dependencies tree manager by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3931
• chore: various co-re fixes by @yanivagman in https://github.com/aquasecurity/tracee/pull/3952
• fix(dependencies): allow multiple removes of same event by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3961
• fix: add missing nodeSelector and tolerations to tracee-operator by @ndegory in https://github.com/aquasecurity/tracee/pull/3944
• Add Iterator generic interface, debut it in Policies by @geyslan in https://github.com/aquasecurity/tracee/pull/3963
• Run x86_64 & aarch64 builds in parallel by @hangrymuppet in https://github.com/aquasecurity/tracee/pull/3962
• chore(ci): run x86_64 & aarch64 builds in parallel by @geyslan in https://github.com/aquasecurity/tracee/pull/3968
• chore: make Cloner generic by @geyslan in https://github.com/aquasecurity/tracee/pull/3966
• fix: capture io by @yanivagman in https://github.com/aquasecurity/tracee/pull/3972
• chore: remove OPT_PROCESS_INFO by @yanivagman in https://github.com/aquasecurity/tracee/pull/3975
• fix: update vagrant file to download kubectl by @rscampos in https://github.com/aquasecurity/tracee/pull/3977
• chore(ci): bump actions versions by @geyslan in https://github.com/aquasecurity/tracee/pull/3969
• Fix Policies Cloning by @geyslan in https://github.com/aquasecurity/tracee/pull/3971
• Add timestamp docker tag for dev image by @hangrymuppet in https://github.com/aquasecurity/tracee/pull/3959
• chore(ci): labeler v5.0.0 is inconsistent by @geyslan in https://github.com/aquasecurity/tracee/pull/3978
• Libbpfgo bump by @geyslan in https://github.com/aquasecurity/tracee/pull/3970
• fix: show argv on failed execve events by @yanivagman in https://github.com/aquasecurity/tracee/pull/3922
• fix(analyze): bind flags with viper by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3981
• fix: wrong print_mem_dump errors about args filter by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3895
• Fix helm install option webhook by @rscampos in https://github.com/aquasecurity/tracee/pull/3984
• fix(ebpf): use debug error level instead of error by @geyslan in https://github.com/aquasecurity/tracee/pull/3985
• refactor: Improve API used by ebpf programs by @yanivagman in https://github.com/aquasecurity/tracee/pull/3982
• fix: vagrantfile url for opa download by @rscampos in https://github.com/aquasecurity/tracee/pull/3990
• chore(deps): bump golang.org/x/net from 0.17.0 to 0.23.0 in /api by @dependabot in https://github.com/aquasecurity/tracee/pull/3991
• chore(deps): bump golang.org/x/net from 0.22.0 to 0.23.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/3992
• fix(ebpf): check if engineOutput is closed by @geyslan in https://github.com/aquasecurity/tracee/pull/3994
• chore: refactor equality computation by @geyslan in https://github.com/aquasecurity/tracee/pull/3997
• Chore at large by @geyslan in https://github.com/aquasecurity/tracee/pull/3979
• Wait for apt locks by @geyslan in https://github.com/aquasecurity/tracee/pull/4000
• Rename context filters to scope filters by @yanivagman in https://github.com/aquasecurity/tracee/pull/3995
• Helm webhook custom templates by @ndegory in https://github.com/aquasecurity/tracee/pull/3942
• fix: proper fragment delimiters in webhook URL by @ndegory in https://github.com/aquasecurity/tracee/pull/3943
• fix event definitions api by @josedonizetti in https://github.com/aquasecurity/tracee/pull/4004
• grpc: update definitions api by @josedonizetti in https://github.com/aquasecurity/tracee/pull/4006
• chore(k8s): prepare v0.21.0 release by @geyslan in https://github.com/aquasecurity/tracee/pull/4007
• [v0.21.0] fix(events): fix process_execute_failed missing symbol for new kernels by @geyslan in https://github.com/aquasecurity/tracee/pull/4011
• fix(events): hidden_kernel_module - change history scan behaviour by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4020
• feat(proctree): control procfs query by config by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4022
• [v0.21.0] capture: fixes and tests by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4023
• [v0.21.0] fix: network event context by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4029
• fix(ebpf): use kprobes for execute_finished by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4030
• fix: avoid logging warnings for non-ELF so loading by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4037
• v0.21.0:chore(events): decrease SO loader error log level to debug by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4041
• fix: remove invalid "format" event from docs by @yanivagman in https://github.com/aquasecurity/tracee/pull/4042
• 0.21.0/fix(tests): fix goroutines leakage in integration tests by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4052
• [v0.21.0] Revert "chore(k8s): prepare v0.21.0 release (#4007)" by @geyslan in https://github.com/aquasecurity/tracee/pull/4055
• chore(helm): rename helm field config file (#4018) by @geyslan in https://github.com/aquasecurity/tracee/pull/4057
• 0.21.0/fix(proctree): limit tree memory usage and reduce it by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4065
• [v0.21.0] fix(build): static build might require zstd lib by @geyslan in https://github.com/aquasecurity/tracee/pull/4070
• [v0.21.0] fix: select cgroup mountpoint with the smallest inode number by @yanivagman in https://github.com/aquasecurity/tracee/pull/4077
• [v0.21.0]Refactor: Optimize GetCgroupPath() memory utilization by @yanivagman in https://github.com/aquasecurity/tracee/pull/4083
• [backport v0.21.0] Integrate libbpfgo helpers by @yanivagman in https://github.com/aquasecurity/tracee/pull/4094
• 0.21.0/fix(changelog): size enforcement corrupted cache by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4079
• [v0.21.0] feature: add enum EventId to event definition (#4085) by @rscampos in https://github.com/aquasecurity/tracee/pull/4101
• [v0.21.0] feat(events): create global event id enum by @rscampos in https://github.com/aquasecurity/tracee/pull/4102
• [backport 0.21.0] Fix ksymbols mem consumption backport by @yanivagman in https://github.com/aquasecurity/tracee/pull/4100
• [backport v0.21.0] feat(events): remove throttle timer in hidden_kernel_module by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4109
• [v0.21.0] chore(api): event definitions api renaming by @rscampos in https://github.com/aquasecurity/tracee/pull/4123
• [v0.21.0] grpc: refactor event structure by @rscampos in https://github.com/aquasecurity/tracee/pull/4124
• [v0.21.0] chore: possible fix for size/RSS issue by @rscampos in https://github.com/aquasecurity/tracee/pull/4132
• [v0.21.0] chore(k8s): prepare v0.21.0 release (#4134) by @rscampos in https://github.com/aquasecurity/tracee/pull/4135
• [v0.21.0] fix(build): bump go to fix cve-2024-24790 by @rscampos in https://github.com/aquasecurity/tracee/pull/4144
• [v0.21.0] release build fix by @geyslan in https://github.com/aquasecurity/tracee/pull/4146
• [v0.21.0] fix(build): fix release build (#4150) by @geyslan in https://github.com/aquasecurity/tracee/pull/4151

New Contributors

• @Tej-Singh-Rana made their first contribution in https://github.com/aquasecurity/tracee/pull/3859
• @ndegory made their first contribution in https://github.com/aquasecurity/tracee/pull/3832
• @sharon-amir made their first contribution in https://github.com/aquasecurity/tracee/pull/3875
• @hangrymuppet made their first contribution in https://github.com/aquasecurity/tracee/pull/3946

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.20.0...v0.21.0

⚡️ Release notes and discussion: https://github.com/aquasecurity/tracee/discussions/3869 ⚡️

Docker Image

• docker pull docker.io/aquasec/tracee:0.20.0

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.20.0
• docker pull docker.io/aquasec/tracee:aarch64-0.20.0

What's Changed

• docs(mkdocs): rename crs to cri in menu by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3671
• Add verify-docs job by @geyslan in https://github.com/aquasecurity/tracee/pull/3672
• rebase of https://github.com/aquasecurity/tracee/pull/3638 by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3683
• Fix readme by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3686
• chore(container): same default events as k8s deployment by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3687
• fix(ebpf): use ts as fd_arg_path_map key by @geyslan in https://github.com/aquasecurity/tracee/pull/3674
• fix(finding): add missing fields by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3694
• refactor(engine): feed engine with signatures events by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3681
• feat(signatures): add simple proctree datasource envelope by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3692
• Make filtered aggregation possible by @geyslan in https://github.com/aquasecurity/tracee/pull/3677
• feature(types): add packet metadata type by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3708
• Packet direction flag by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3706
• minor fix on top of https://github.com/aquasecurity/tracee/pull/3707 by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3709
• probes: improve probes by having specific getters by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3710
• feat(types): time relevant info for proctree by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3712
• docs: add discussion template for adopters by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3702
• Feature/proctree query time by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3691
• Feature: DNS Cache datasource by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3679
• chore: rename Context to EventContext by @geyslan in https://github.com/aquasecurity/tracee/pull/3716
• Pin pandoc version to 3.1.2 by @geyslan in https://github.com/aquasecurity/tracee/pull/3720
• libbpfgo bump to v0.6.0-libbpf-1.3 by @geyslan in https://github.com/aquasecurity/tracee/pull/3713
• make https://github.com/aquasecurity/tracee/pull/3715 pass doc verification by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3721
• chore(ci): bump changed-files to v40.2.0 by @geyslan in https://github.com/aquasecurity/tracee/pull/3723
• bugfix(ebpf): avoid errors upon hash calc fail by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3733
• fix: webhook template should support sprig funcs by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3724
• feature: add ctime to containers data source by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3728
• chore(release): use go1.20 for releasing by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3740
• chore: fix typo by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3736
• fix(release): tracee-container alpine version to 3.18 by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3744
• Network: add net_tcp_connect event with DNS support by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3738
• chore: refer to man pages by @geyslan in https://github.com/aquasecurity/tracee/pull/3749
• feature: pluggable datasources by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3737
• Bugfix/parse finding type correctly by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3760
• Writeable datasource types by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3759
• feature(api): add data source grpc service by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3761
• chore(api): fix typo by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3762
• chore(makefile): fix doube-quoted version string by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3764
• feat(ebpf): optimize sendmsg/recvmsg kprobes by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3766
• feature(event): create net_flow_tcp_begin event by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3750
• fix(network): fix http request/response events by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3770
• chore: update proto types by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3772
• chore(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/3773
• fix(ebpf): adjust inode struct to kernel v6.6 by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3769
• feat(types): improve datasource write api by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3763
• fix: filter dispatching to signatures by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3729
• feature: Add name and properties to Threat, and add Threat to Event definition. by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3742
• feature: writeable data source by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3725
• Improve performance of exec-hash by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3752
• fix: create pid file under install-path by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3775
• feature: add signature name to event definition by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3743
• add Struct type and detect.FindingData by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3776
• Fix dynamic data arguments by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3777
• chore(derive/http): change log level when packets are malformed by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3780
• Types protected finding by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3782
• Protected finding data by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3779
• chore(deps): bump tj-actions/changed-files from 40.2.0 to 41.0.0 in /.github/workflows by @dependabot in https://github.com/aquasecurity/tracee/pull/3788
• fix: use thread safe wrapper for ksyms table by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3786
• fix: triggeredBy should print event on table output by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3792
• fix(doc): contribution document link by @yasindce1998 in https://github.com/aquasecurity/tracee/pull/3794
• Pin revive version by @geyslan in https://github.com/aquasecurity/tracee/pull/3796
• fix(ebpf): fix hidden_kernel_module error in some kernels by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3797
• fix(events): restore dependency in hooked_syscall by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3784
• Introduce Policies versioning (map of maps) by @geyslan in https://github.com/aquasecurity/tracee/pull/3305
• Update Golang in all Project by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3806
• chore(docs): specify distros and versions support by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3808
• Remove BPF map macros by @geyslan in https://github.com/aquasecurity/tracee/pull/3735
• Fix event data structure by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3812
• Fix symbol multi addrs by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3802
• chore(ci): add mantic 6.6 AMIs by @geyslan in https://github.com/aquasecurity/tracee/pull/3810
• fix(capture): restore absolute time in pcap frames by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3800
• Update api types by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3814
• feat(signatures): expose signatures helpers as Go module by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3765
• chore(deps): bump github.com/containerd/containerd from 1.7.0 to 1.7.11 by @dependabot in https://github.com/aquasecurity/tracee/pull/3816
• Make policies config versioned by @geyslan in https://github.com/aquasecurity/tracee/pull/3809
• chore: remove replace of signatures helpers by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3819
• grpc: fix nil arguments by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3823
• chore: remove clang march flag by @geyslan in https://github.com/aquasecurity/tracee/pull/3831
• chore: increase vb resources by @geyslan in https://github.com/aquasecurity/tracee/pull/3833
• fix: skip timestamp normalizing in derived events by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3835
• fix: change missing probe log level by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3836
• chore(deps): bump github.com/opencontainers/runc from 1.1.7 to 1.1.12 by @dependabot in https://github.com/aquasecurity/tracee/pull/3837
• Fix ArgsNum by @geyslan in https://github.com/aquasecurity/tracee/pull/3839
• Fix typo in kubernetes install guide by @logicfox in https://github.com/aquasecurity/tracee/pull/3846
• Various cgroup and mounting fixes and optimizations by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3829
• fix(processors): change args values by name by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3838
• Set exec-hash default option by @geyslan in https://github.com/aquasecurity/tracee/pull/3852
• chore(k8s): prepare v0.20.0 release by @geyslan in https://github.com/aquasecurity/tracee/pull/3853

New Contributors

• @yasindce1998 made their first contribution in https://github.com/aquasecurity/tracee/pull/3794
• @logicfox made their first contribution in https://github.com/aquasecurity/tracee/pull/3846

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.19.0...v0.20.0

Docker Image

• docker pull docker.io/aquasec/tracee:0.19.0

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.19.0
• docker pull docker.io/aquasec/tracee:aarch64-0.19.0

Docker Image

• docker pull docker.io/aquasec/tracee:0.18.1

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.18.1
• docker pull docker.io/aquasec/tracee:aarch64-0.18.1

Docker Image (x86_64 only)

• docker pull docker.io/aquasec/tracee:0.18.0

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.18.0
• docker pull docker.io/aquasec/tracee:aarch64-0.18.0

What's Changed

• make: set LIBBPFGO_OSRELEASE_FILE default value by @geyslan in https://github.com/aquasecurity/tracee/pull/3226
• chore: migrate to golang-lru v2 by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3140
• (extensions) probes: create probe group, events: start work by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3223
• flags: refactor FilterMap by @yanivagman in https://github.com/aquasecurity/tracee/pull/3222
• go.mod: remove types replace by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3236
• containers: trim mountpoint from stored paths by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3231
• docs: remove old trace subcommand by @geyslan in https://github.com/aquasecurity/tracee/pull/3238
• ebpf: pipeline: reduce iteration over policies by @geyslan in https://github.com/aquasecurity/tracee/pull/3209
• engine: fix panic on waitgroup by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3233
• Update packaging.md for Ubuntu package building by @pimvh in https://github.com/aquasecurity/tracee/pull/3243
• ebpf: fix socket_accept event by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3240
• fix: fix container edge case in events pipeline by @geyslan in https://github.com/aquasecurity/tracee/pull/3253
• tracee: skip golang plugin for static binaries by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3244
• Fix typo in Vagrantfile's comment by @64J0 in https://github.com/aquasecurity/tracee/pull/3260
• tracee: signatures-dir accept multiple values by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3246
• change hooked_syscalls event so users can specify syscalls to check. by @AsafEitani in https://github.com/aquasecurity/tracee/pull/3136
• events: hidden_kernel_module changes by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3255
• config: extract config structs to its own pkg by @geyslan in https://github.com/aquasecurity/tracee/pull/3228
• eBPF control plane signals by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3237
• build: remove signing from snapshot by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3271
• release: bump release tag to 0.16.0 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3272
• fix: send init events to pipeline by @geyslan in https://github.com/aquasecurity/tracee/pull/3270
• thread-safety issues fix by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3265
• fix(pkg/events): fix tailcall dependencies race issues by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3274
• build: remove release on tag push by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3273
• chore: move syscaller to dist by @geyslan in https://github.com/aquasecurity/tracee/pull/3269
• fix(tests): fix input paths in parsecmd test by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3275
• tracee: add analyze cmd by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3101
• policies: rename list fields to be plural by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3242
• fix(pkg/counter): finish making counter atomic by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3276
• fix: derived event not triggering if base filtered by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3280
• enrich: fixes post control plane by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3285
• docs: add analyze documentation by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3292
• doc: add tutorial to verify tracee signature by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3291
• fix: signature event not triggering if base filtered by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3281
• pipeline memory efficiency using pool by @geyslan in https://github.com/aquasecurity/tracee/pull/3297
• events: update syscall_pathname for security_file_open by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3298
• Events and Scope flags by @geyslan in https://github.com/aquasecurity/tracee/pull/3262
• pkg/containers: fix deadlock by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3311
• [v0.16.0] chore: bump k8s tag to 0.16.1 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3316
• docs: updating link to tracee docs for search results by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3317
• feature: remove policy actions by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3314
• fix(server): re-enable prometheus counters. by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3304
• fix (cgroups): already dead edge case by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3325
• docs: updating policies overview by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3318
• chore bump 0.16.2 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3331
• feature(k8s): policy k8s compatible by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3330
• chore: bump k8s tag to 0.17.0 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3336
• fix(ebpf): size of mntns/pidns filters key holders by @geyslan in https://github.com/aquasecurity/tracee/pull/3337
• fix: validate policy names are rfc 1123 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3335
• remove help command, create flags markdown docs by @geyslan in https://github.com/aquasecurity/tracee/pull/3321
• fix: data source registration after NewEngine by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3342
• fix(build): btfhub's bpftool in alpine container by @geyslan in https://github.com/aquasecurity/tracee/pull/3349
• chore(build): add LOGFROM flag to check-pr rule by @geyslan in https://github.com/aquasecurity/tracee/pull/3348
• chore(build): change check-pr output format by @geyslan in https://github.com/aquasecurity/tracee/pull/3351
• refactor(events): new event definitions (mutable vs immutable data) by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3340
• fix(filter): remove unneeded workaround by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3352
• events: adjust hidden kernel module event to v6.4 by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3360
• fix(config): loading config file by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3370
• Update the URL as the old one did not lead to the grafana tutorial an… by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3371
• chore(docs): add note for quote yaml value by @geyslan in https://github.com/aquasecurity/tracee/pull/3367
• chore: bump k8s tags to 0.17.1 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3374
• bugfix(capture): remove CONFIG_KALLSYMS_ALL dependency by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3381
• docs: additional resources for the docs by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3379
• feat: add tracee rpc service by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3389
• feat: add loggers atomic level by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3391
• Add grpc server by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3390
• --help flag parsing by @geyslan in https://github.com/aquasecurity/tracee/pull/3393
• feat: add diagnostic rpc by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3395
• Add grpc diagnostic by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3394
• fix: k8s policies tutorial by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3373
• chore(flags): change scope/event flag parsers by @geyslan in https://github.com/aquasecurity/tracee/pull/3343
• fix: log level should match zap log priority by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3409
• fix: ignore error for cgroups that doesn't exist by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3410
• refactor: getStackAddresses doesn't return an err by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3414
• chore(revive): mitigate redundant warning by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3417
• fix: committing typo by @testwill in https://github.com/aquasecurity/tracee/pull/3418
• feature(types): add task identifier by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3425
• fix(flags): use scope flag parser for policy by @geyslan in https://github.com/aquasecurity/tracee/pull/3429
• fix: capture of writev by @roikol in https://github.com/aquasecurity/tracee/pull/3413
• fix: fix section name for vfs_readv by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3421
• feat: filter file capture by ELF type by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3361
• docs: modifying readme by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3378
• Fix(capture): fix verifier issue with elf capture by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3433
• fix: print_mem_dump fails on missing symbol by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3384
• Revert "fix: print_mem_dump fails on missing symbol (#3384)" by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3436
• fix(definitions): ksymbols dependencies handled wrongly by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3443
• feat: add streams by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3411
• Add definition proto by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3447
• feat: add argv to security_bprm_check by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3442
• Fix closed chan read 2 by @geyslan in https://github.com/aquasecurity/tracee/pull/3438
• feat: add version proto by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3459
• feat: add version and description to definition by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3437
• Add enable/disable rule by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3431
• build(deps): bump github.com/cyphar/filepath-securejoin from 0.2.3 to 0.2.4 by @dependabot in https://github.com/aquasecurity/tracee/pull/3452
• Update Readme.md by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3434
• chore(revive): disable unchecked-type-assertion by @geyslan in https://github.com/aquasecurity/tracee/pull/3474
• Rename !container and binary scope filters by @geyslan in https://github.com/aquasecurity/tracee/pull/3451
• Add definition grpc endpoint by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3450
• feat: add enable/disable event rpc by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3467
• docs: adding guidelines on contributing to the documentation by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3415
• docs: changes to the policies documentation by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3416
• feature(proctree): Introduce a process tree by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3364
• chore(libbpfgo): bump to v0.5.0-libbpf-1.2 by @geyslan in https://github.com/aquasecurity/tracee/pull/3482
• chore(ebpf): not fail if some ksymbol is not found by @geyslan in https://github.com/aquasecurity/tracee/pull/3476
• chore(tests): comment out init sighup test by @geyslan in https://github.com/aquasecurity/tracee/pull/3483
• fix: remove params from event definition proto by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3485
• feat: add event enable/disable by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3466
• feat: add enable/disable event grpc endpoint by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3487
• feat: Add new event structure by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3465
• fix: regenerate definition.pb.go by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3490
• feat: add StreamEvents rpc by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3491
• fix: GetEventDefinition doesn't have params by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3492
• fix: rename policy apiVersion and kind by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3484
• fix(proctree): include thread group leader in threads LRU map by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3494
• fix(ebpf): fix symbol name on error by @geyslan in https://github.com/aquasecurity/tracee/pull/3497
• fix: stackaddress needs to have symbol name by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3499
• Revert "fix(ebpf): fix symbol name on error" by @geyslan in https://github.com/aquasecurity/tracee/pull/3501
• feat: add event_data to event proto by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3496
• Add streams endpoint by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3493
• fix(packaging): adjust ubuntu and fedora packaging by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3502
• fix(ebpf): triggerMemDump check all filters by @geyslan in https://github.com/aquasecurity/tracee/pull/3504
• Types change for #3503 by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3506
• events: add ftrace_hook event by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3412
• fix: fix uint and string types by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3507
• feat(event): export thread, process and parent entity id by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3503
• feat(types): add proctree datasource by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3509
• fix: make types uniform with wrappers by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3512
• fix: fix tactic, and int32_array names by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3514
• Chore build by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3513
• Log probe attachment error, continue running by @geyslan in https://github.com/aquasecurity/tracee/pull/3495
• fix: convert []trace.Argument into map<string,EventData> by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3510
• fix: link cosign tutorial to mkdocs.yml by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3515
• fix(proctree): allow regular events to create proctree nodes by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3498
• docs: Fix incorrect flags and usage documentation for unlinkat by @kdrag0n in https://github.com/aquasecurity/tracee/pull/3306
• chore(vagrant): add support to arm64 architecture by @geyslan in https://github.com/aquasecurity/tracee/pull/3464
• fix(Vagrantfile): wrong var reference by @geyslan in https://github.com/aquasecurity/tracee/pull/3523
• docs: running tracee docker container on amd64 and arm64 by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/3456
• feat(proctree): create process tree data source by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3522
• feat(types): add executable to event by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3524
• docs(contributing): update vagrant hypervisor info by @geyslan in https://github.com/aquasecurity/tracee/pull/3525
• feature(proctree): enrich events with executable from proctree by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3526
• chore(k8s): bump k8s tag to v0.18.0 by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3527

New Contributors

• @pimvh made their first contribution in https://github.com/aquasecurity/tracee/pull/3243
• @64J0 made their first contribution in https://github.com/aquasecurity/tracee/pull/3260
• @testwill made their first contribution in https://github.com/aquasecurity/tracee/pull/3418
• @kdrag0n made their first contribution in https://github.com/aquasecurity/tracee/pull/3306

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.15.1...v0.18.0

Docker Image (x86_64 only)

• docker pull docker.io/aquasec/tracee:0.17.1

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.17.1
• docker pull docker.io/aquasec/tracee:aarch64-0.17.1

Docker Image (x86_64 only)

• docker pull docker.io/aquasec/tracee:0.17.0

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.17.0
• docker pull docker.io/aquasec/tracee:aarch64-0.17.0

Docker Image (x86_64 only)

• docker pull docker.io/aquasec/tracee:0.16.2

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.16.2
• docker pull docker.io/aquasec/tracee:aarch64-0.16.2

What's Changed

• [v0.16.0] backport: dead cgroups fix by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3326

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.16.1...v0.16.2

Docker Image (x86_64 only)

• docker pull docker.io/aquasec/tracee:0.16.1

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.16.1
• docker pull docker.io/aquasec/tracee:aarch64-0.16.1

What's Changed

• pkg/containers: fix deadlock @josedonizetti in https://github.com/aquasecurity/tracee/pull/3311

Docker Image (x86_64 only)

• docker pull docker.io/aquasec/tracee:0.16.0

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.16.0
• docker pull docker.io/aquasec/tracee:aarch64-0.16.0

What's Changed

• make: set LIBBPFGO_OSRELEASE_FILE default value by @geyslan in https://github.com/aquasecurity/tracee/pull/3226
• chore: migrate to golang-lru v2 by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3140
• (extensions) probes: create probe group, events: start work by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3223
• flags: refactor FilterMap by @yanivagman in https://github.com/aquasecurity/tracee/pull/3222
• go.mod: remove types replace by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3236
• containers: trim mountpoint from stored paths by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3231
• docs: remove old trace subcommand by @geyslan in https://github.com/aquasecurity/tracee/pull/3238
• ebpf: pipeline: reduce iteration over policies by @geyslan in https://github.com/aquasecurity/tracee/pull/3209
• engine: fix panic on waitgroup by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3233
• Update packaging.md for Ubuntu package building by @pimvh in https://github.com/aquasecurity/tracee/pull/3243
• ebpf: fix socket_accept event by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3240
• fix: fix container edge case in events pipeline by @geyslan in https://github.com/aquasecurity/tracee/pull/3253
• tracee: skip golang plugin for static binaries by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3244
• Fix typo in Vagrantfile's comment by @64J0 in https://github.com/aquasecurity/tracee/pull/3260
• tracee: signatures-dir accept multiple values by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3246
• change hooked_syscalls event so users can specify syscalls to check. by @AsafEitani in https://github.com/aquasecurity/tracee/pull/3136
• events: hidden_kernel_module changes by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3255
• config: extract config structs to its own pkg by @geyslan in https://github.com/aquasecurity/tracee/pull/3228
• eBPF control plane signals by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3237
• build: remove signing from snapshot by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3271
• release: bump release tag to 0.16.0 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3272
• fix: send init events to pipeline by @geyslan in https://github.com/aquasecurity/tracee/pull/3270
• thread-safety issues fix by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3265
• fix(pkg/events): fix tailcall dependencies race issues by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3274
• build: remove release on tag push by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3273
• chore: move syscaller to dist by @geyslan in https://github.com/aquasecurity/tracee/pull/3269
• fix(tests): fix input paths in parsecmd test by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3275
• tracee: add analyze cmd by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3101
• policies: rename list fields to be plural by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3242
• [v0.16.0] fix(pkg/counter): finish making counter atomic (#3276) by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3284
• [v0.16.0] fix: derived event not triggering if base filtered by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3287
• [v0.16.0] fix: enrich post control plane (#3285) by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3289

New Contributors

• @pimvh made their first contribution in https://github.com/aquasecurity/tracee/pull/3243
• @64J0 made their first contribution in https://github.com/aquasecurity/tracee/pull/3260

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.15.1...v0.16.0

Docker Image (x86_64 only)

• docker pull docker.io/aquasec/tracee:0.15.1

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.15.1
• docker pull docker.io/aquasec/tracee:aarch64-0.15.1

What's Changed

• workflow: fix cosign signing by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3212
• make integration tests more robust by @geyslan in https://github.com/aquasecurity/tracee/pull/2688
• tests: fix event MatchedPoliciesUser check by @geyslan in https://github.com/aquasecurity/tracee/pull/3220
• vagrant: clean up/fix provisioning script by @geyslan in https://github.com/aquasecurity/tracee/pull/3216
• Create SECURITY.md by @itaysk in https://github.com/aquasecurity/tracee/pull/3221
• ebpf: fix mem_prot_alert anonymous file info by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3225
• makefile: add check-pr rule by @geyslan in https://github.com/aquasecurity/tracee/pull/3215
• tracee: fix panic when ctrl-c after the boot by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3188
• k8s: bump release tag to 0.15.1 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3232

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.15.0...v0.15.1

Docker Image (x86_64 only)

• docker pull docker.io/aquasec/tracee:0.15.0

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.15.0
• docker pull docker.io/aquasec/tracee:aarch64-0.15.0

What's Changed

• workflow: add cosign to release snapshot by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3102
• workflow: add cosign to release snapshot by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3104
• workflow: ignore cosign prompt by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3105
• workflow: sign aquasec/tracee:x86_64-dev by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3106
• k8s: enrichment enabled by default by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3096
• docs: remove classic-docs by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3099
• workflow: sign release images by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3107
• refactor: add broadcast printer by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3090
• k8s: remove postee denpedency by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3089
• policies: fix args filtering by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3115
• tracee: add ready callback by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3117
• Add k8s configmap by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3091
• fix: file_modification not triggered in newer kernels by @roikol in https://github.com/aquasecurity/tracee/pull/3127
• docs: fix mkdocs by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3131
• k8s: add readiness probe by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3128
• refactor: move PolicyFile to policy pkg by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3125
• k8s: add default signatures policy by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3130
• k8s: fix helm installation by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3134
• k8s: fix k8s installation docs by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3139
• k8s: add helm test workflow by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3138
• types: add DataSource type for signatures by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3141
• 3026 rebased by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3142
• ebpf: create function prototypes in all headers by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3133
• policy: fix validation of args and retval by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3144
• logger: flags: add filter and filter-out by @geyslan in https://github.com/aquasecurity/tracee/pull/3137
• docs: examples: place examples files by kind by @geyslan in https://github.com/aquasecurity/tracee/pull/3146
• Add policy printer by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3126
• bpf attach raw tracepoint support (rebase of #3060) by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3148
• Feature/capture read by @AlonZivony in https://github.com/aquasecurity/tracee/pull/2356
• events: improve hidden_kernel_module by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3001
• types: add ContainerID field back by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3155
• chore: restore old ContainerID field by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3154
• bpf: fix int truncation in address holder by @geyslan in https://github.com/aquasecurity/tracee/pull/3159
• docs: add data sources by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3164
• ebpf: events: set policies for init events by @geyslan in https://github.com/aquasecurity/tracee/pull/3162
• policy: add not-equal operator parsing by @geyslan in https://github.com/aquasecurity/tracee/pull/3168
• printer: fix policy printer by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3149
• docs: update docs for bpf_attach event by @roikol in https://github.com/aquasecurity/tracee/pull/3178
• docs: add read capture and new filters docs by @AlonZivony in https://github.com/aquasecurity/tracee/pull/3157
• Fix docs by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3175
• policy: actions printers configured with -output by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3176
• events: fix hidden_kernel_module trigger time by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3189
• tracee: clean up untraced signatures by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3193
• Revert "tracee: clean up untraced signatures" by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3194
• policy: fix output options by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3192
• tracee: fix output configuration via configfile by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3187
• types: change Event fields by @geyslan in https://github.com/aquasecurity/tracee/pull/3196
• ebpf: Pipeline and BPF Network policy matching by @geyslan in https://github.com/aquasecurity/tracee/pull/3183
• ebpf: bitwise should_submit_net_event return by @geyslan in https://github.com/aquasecurity/tracee/pull/3198
• Fix path check multiple pids by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3205
• k8s: bump release tag to 0.15.0 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3204
• workflow: fix contents permissions by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3206

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.14.2...v0.15.0

Docker Image (x86_64 only)

• docker pull docker.io/aquasec/tracee:0.14.2

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.14.2
• docker pull docker.io/aquasec/tracee:aarch64-0.14.2

What's Changed

• release: fix arm64 release file by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3084
• release: fix arm64 releasing workflow by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3085
• build(deps): bump github.com/docker/distribution from 2.8.1+incompatible to 2.8.2+incompatible by @dependabot in https://github.com/aquasecurity/tracee/pull/3094
• btfhub: fix tracee container image with btfhub by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3095
• btfhub: extract embedded BTF file correctly by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3097
• Fix logger by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3092

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.14.1...v0.14.2

Docker Image (x86_64 only)

• docker pull docker.io/aquasec/tracee:0.14.1

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.14.1
• docker pull docker.io/aquasec/tracee:aarch64-0.14.1

What's Changed (Bug Fix Release)

• feat: support running tracee from pid ns by @roikol in https://github.com/aquasecurity/tracee/pull/3037
• libbpfgo: trim suffix newline from libbpf message by @geyslan in https://github.com/aquasecurity/tracee/pull/3038
• cli: don't sort flags in help/usage messages by @yanivagman in https://github.com/aquasecurity/tracee/pull/3042
• cmd: log only after tracee.Run() by @geyslan in https://github.com/aquasecurity/tracee/pull/3048
• ebpf: use new libbpf syscall macros by @yanivagman in https://github.com/aquasecurity/tracee/pull/3040
• workflow: move workflows to aqua infrastructure by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3056
• tracee: move metrics register to tracee by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3049
• cmd: cobra: fix parsing for multiple values by @geyslan in https://github.com/aquasecurity/tracee/pull/3058
• add pid to memory capture and change the timestamp to epoch or relative by @AsafEitani in https://github.com/aquasecurity/tracee/pull/3047
• v0.14.1 dependencies updates (security, ...) and an urfave quick fix by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3067
• fix deadlocks triggered by cancelled ctx by @geyslan in https://github.com/aquasecurity/tracee/pull/3059
• change mem_prot_alert alert from W+E to W by @AsafEitani in https://github.com/aquasecurity/tracee/pull/3073
• change mem_prot_alert to detect W to E instead W+E to E. by @AsafEitani in https://github.com/aquasecurity/tracee/pull/3062
• make print_mem_dump reprint on kernel module load by @AsafEitani in https://github.com/aquasecurity/tracee/pull/3072
• fix for kernels v6.3 and mitigation for tracee.pid in tests by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3076
• remove pid file on exit by @geyslan in https://github.com/aquasecurity/tracee/pull/3075
• Bump libbpfgo to v0.4.8.1-libbpf-1.2.0 by @geyslan in https://github.com/aquasecurity/tracee/pull/3080
• fix: correct list of bpf helpers by @roikol in https://github.com/aquasecurity/tracee/pull/3064
• tracee: warn only if pidfile removal fails by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3081

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.14.0...v0.14.1

⚡️ Release notes: https://github.com/aquasecurity/tracee/discussions/3041 ⚡️

Docker Image (x86_64 only)

• docker pull docker.io/aquasec/tracee:0.14.0

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.14.0
• docker pull docker.io/aquasec/tracee:aarch64-0.14.0

What's Changed

• fix: strip v from docker images tags by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2985
• temporary: adjust github image tags for latest releases by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2986
• temporary: typo fix for arm64 release tag by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2987
• temporary: remove temporary workflow that fixed docker tags by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2988
• performance: introduce automated performance dashboard with pyroscope by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2968
• logger: refactor logger configuration by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/2971
• feat: support unmarshalling trace types by @roikol in https://github.com/aquasecurity/tracee/pull/2937
• chore: bump postee to 2.9.0 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2981
• capabilities: drop capabilities by default by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2924
• fix: add file to error message when parsing yaml by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2995
• consume remaining events after ctx is done by @geyslan in https://github.com/aquasecurity/tracee/pull/2969
• docs: remove tracee-action metion by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2997
• Important Network Fixes for Tracee by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2982
• Enable a Debug Shell for Test Runners by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2999
• workflow: raise timeout limit for debug shell jobs by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3005
• feat: unmarshall trace types correctly by @roikol in https://github.com/aquasecurity/tracee/pull/2996
• feat: use new types in signatures by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3009
• fix: support null values in unmarshalling by @roikol in https://github.com/aquasecurity/tracee/pull/3011
• types: update tracee to use latest types by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3012
• fix multiple symbols prints bug by @AsafEitani in https://github.com/aquasecurity/tracee/pull/3002
• Capabilities fixes by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3006
• fix: kernel version comparison by @roikol in https://github.com/aquasecurity/tracee/pull/3022
• fix: detect container id from cgroup in GitHub Action by @ShiraCohen33 in https://github.com/aquasecurity/tracee/pull/3021
• events: fix missing capability hidden_kernel_module by @OriGlassman in https://github.com/aquasecurity/tracee/pull/3014
• ebpf: non non-core. building files. by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3015
• tracee: add engine field to tracee object by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/3024
• events: fix hidden_kernel_module derivation by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3025
• Revive by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3020
• Fix docs by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3010
• ebpf: adjust includes left behind by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3028
• k8s: bump to 0.14.0 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3030
• tracee one binary cli migration to cobra/viper by @geyslan in https://github.com/aquasecurity/tracee/pull/3000
• libbpf + libbpfgo bump by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3032
• workflow: fix mkdocs-dev workflow to ubuntu-latest by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/3034

New Contributors

• @ShiraCohen33 made their first contribution in https://github.com/aquasecurity/tracee/pull/3021

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.13.1...v0.14.0

⚡️ Release notes and discussion: https://github.com/aquasecurity/tracee/discussions/2989 ⚡️

Docker Images (x86_64 only)

• docker pull docker.io/aquasec/tracee:0.13.1
• docker pull docker.io/aquasec/tracee:0.13.1-full

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.13.1
• docker pull docker.io/aquasec/tracee:x86_64-0.13.1-full
• docker pull docker.io/aquasec/tracee:aarch64-0.13.1
• docker pull docker.io/aquasec/tracee:aarch64-0.13.1-full

The regular image is built with an embedded portable CO-RE eBPF object and BTFHub (for kernels not supporting BTF info). The full image is built with an embedded portable CO-RE eBPF object and it is capable of building a per kernel non CO-RE eBPF object.

What's Changed

• events: fix return value of process_execute_failed event by @OriGlassman in https://github.com/aquasecurity/tracee/pull/2964
• Policies mntns issue and Segfault fix by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2974
• docs: add bpf capture documentation by @yanivagman in https://github.com/aquasecurity/tracee/pull/2976
• docs: fix logging documentation by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2977
• Fix mnt docs by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2978
• build(deps): bump github.com/docker/docker from 20.10.21+incompatible to 20.10.24+incompatible by @dependabot in https://github.com/aquasecurity/tracee/pull/2979
• k8s: bump tag to 0.13.1 by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2983
• sig: engine: copy event before engine processing by @geyslan in https://github.com/aquasecurity/tracee/pull/2984

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.13.0...v0.13.1

⚡️ Release notes and discussion: https://github.com/aquasecurity/tracee/discussions/2963⚡️

Docker Images (x86_64 only)

• docker pull docker.io/aquasec/tracee:0.13.0
• docker pull docker.io/aquasec/tracee:0.13.0-full

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.13.0
• docker pull docker.io/aquasec/tracee:x86_64-0.13.0-full
• docker pull docker.io/aquasec/tracee:aarch64-0.13.0
• docker pull docker.io/aquasec/tracee:aarch64-0.13.0-full

The regular image is built with an embedded portable CO-RE eBPF object and BTFHub (for kernels not supporting BTF info). The full image is built with an embedded portable CO-RE eBPF object and it is capable of building a per kernel non CO-RE eBPF object.

What's Changed

• workflow: turn github node jobs paralell by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2805
• docs: small fixes by @yanivagman in https://github.com/aquasecurity/tracee/pull/2811
• standardize error/log first letter by @geyslan in https://github.com/aquasecurity/tracee/pull/2812
• cleanup: order import blocks by @geyslan in https://github.com/aquasecurity/tracee/pull/2815
• docs: fix readme links by @yanivagman in https://github.com/aquasecurity/tracee/pull/2816
• [ARM64 TESTS] workflow: add arm64 runners and tests by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2817
• builder: add goimports to tracee-make docker imgs by @geyslan in https://github.com/aquasecurity/tracee/pull/2828
• workflow: add alma linux as rhel clone to the PR workflow by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2831
• Workflow paths by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2833
• docs: fix readme docs links by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2837
• events: fix signature event name by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2839
• chore: go mod tidy by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2843
• workflow: pr: reenable TRC-103 by @geyslan in https://github.com/aquasecurity/tracee/pull/2840
• workflow: pr: enable tests in arm64 and rhel_arm64 by @geyslan in https://github.com/aquasecurity/tracee/pull/2844
• workflow: test other tools builds as well by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2848
• maintenance: build: enable arm64 container images, fix building by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2849
• workflow: update AMI IDs for 30GB images by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2850
• workflow: change release AMI IDs to latest by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2851
• chore: fix deprecated nodejs warning for github action by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2856
• go: update runc from 1.1.2 to 1.1.4 due to security by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2857
• workflow: login to docker.io before docker pulls by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2859
• go: fix security issue CVE-2022-1996 by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2861
• workflow: fix release-snapshot with dev-full tag by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2862
• feat: add PTRACE_POKEDATA to ptrace_code_injection by @roikol in https://github.com/aquasecurity/tracee/pull/2846
• workflow: fix: github login action not working by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2865
• chore: enable btfhub after arm64 changes by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2867
• workflow: change release AMI IDs to latest (#2851) by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2869
• feat: add inotify_find_inode event by @roikol in https://github.com/aquasecurity/tracee/pull/2794
• errfmt: introduce new package for error formatting by @geyslan in https://github.com/aquasecurity/tracee/pull/2842
• workflow: update AMI IDs by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2872
• workflow: add PRs labeler by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2875
• workflow: updates to the workflow by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2877
• workflow: snapshot labels for jenkins are too long by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2878
• types: add SignatureContext type for init by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/2880
• Logger in signatures by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/2864
• types: matchedScopes -> matchedPolicies by @geyslan in https://github.com/aquasecurity/tracee/pull/2881
• rename scopes related to policies by @geyslan in https://github.com/aquasecurity/tracee/pull/2845
• make go routines shutdown gracefully by @geyslan in https://github.com/aquasecurity/tracee/pull/2784
• ebpf: remove params_type_map and use events_map instead by @yanivagman in https://github.com/aquasecurity/tracee/pull/2825
• workflow: re-enable v4.19 and add arm64 version by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2879
• workflow: add amzn2 5.10 kernel AMIs to tests by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2885
• ebpf: remove bin_args_map by @yanivagman in https://github.com/aquasecurity/tracee/pull/2813
• tests: disable cache for integration tests by @geyslan in https://github.com/aquasecurity/tracee/pull/2884
• workflow: add gke 5.4, 5.10 and 5.15 kernel AMIs to tests by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2886
• check relevant error returns by @geyslan in https://github.com/aquasecurity/tracee/pull/2818
• fix: base event filters by @yanivagman in https://github.com/aquasecurity/tracee/pull/2897
• fix: fix old_path arg of security_inode_rename by @roikol in https://github.com/aquasecurity/tracee/pull/2895
• add bpf byte code capture by @AsafEitani in https://github.com/aquasecurity/tracee/pull/2874
• feat: add helpers list to bpf_attach by @roikol in https://github.com/aquasecurity/tracee/pull/2855
• ebpf: align execve enter and exit timestamps by @yanivagman in https://github.com/aquasecurity/tracee/pull/2853
• workflow: pr: enable tests in all archs by @geyslan in https://github.com/aquasecurity/tracee/pull/2863
• workflow: pr: enable TRC-104 test in RHEL ARM64 by @geyslan in https://github.com/aquasecurity/tracee/pull/2910
• fix: use correct type for bpf helpers by @roikol in https://github.com/aquasecurity/tracee/pull/2912
• feat: use libbpfgo helpers to parse bpf helpers by @roikol in https://github.com/aquasecurity/tracee/pull/2905
• libbpf bump by @geyslan in https://github.com/aquasecurity/tracee/pull/2911
• Revert "libbpf: bump to v1.1.0 (#2911)" by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2917
• refactor: move log-file to be under --log by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2909
• skip arg filtering for PrintMemDump by @geyslan in https://github.com/aquasecurity/tracee/pull/2914
• Policies by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2892
• types: add container and kubernetes context fields by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/2921
• Enrich image digest by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/2760
• add syscall support for print_mem_dump by @AsafEitani in https://github.com/aquasecurity/tracee/pull/2903
• types: event policy name by @geyslan in https://github.com/aquasecurity/tracee/pull/2922
• containers: parse ContainerID by inner cgroup by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/2925
• policy: enrich matched event with policy name by @geyslan in https://github.com/aquasecurity/tracee/pull/2923
• Policy number CLI removal by @geyslan in https://github.com/aquasecurity/tracee/pull/2919
• Feature/improve symbols loaded performance by @AlonZivony in https://github.com/aquasecurity/tracee/pull/2891
• tests: re-enable integration for policies by @geyslan in https://github.com/aquasecurity/tracee/pull/2927
• events: add process_execute_failed event by @OriGlassman in https://github.com/aquasecurity/tracee/pull/2858
• events: prevent symbols map cache corruption by @AlonZivony in https://github.com/aquasecurity/tracee/pull/2930
• chore: add tracee logos by @itaysk in https://github.com/aquasecurity/tracee/pull/2931
• build(deps): bump github.com/opencontainers/runc from 1.1.4 to 1.1.5 by @dependabot in https://github.com/aquasecurity/tracee/pull/2932
• policies: fix container scope by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2938
• Add hidden linux kernel module event by @OriGlassman in https://github.com/aquasecurity/tracee/pull/2714
• docs: add policies reference documentation by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2936
• docs: update docs to reflect new binary by @geyslan in https://github.com/aquasecurity/tracee/pull/2939
• improve policies overview by @yanivagman in https://github.com/aquasecurity/tracee/pull/2947
• Fix policy docs newline by @yanivagman in https://github.com/aquasecurity/tracee/pull/2948
• k8s: bump version by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2949
• chore: release minor fixes by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2951
• release: makefile change to sign all images by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2952
• release: crane is buggy, remove until fixed by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2953
• makefile: remove cosign leftover and fix release makefile by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2955
• workflows: make release like the snapshot logic by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2958
• release: fix release_notes.txt placement by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2959
• release: create tgz at the end because of cleans by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2960
• release: re-enable BTFHUB before release by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2962

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.12.0...v0.13.0

⚡️ Release notes and discussion: https://github.com/aquasecurity/tracee/discussions/2803 ⚡️

Docker images

• docker pull docker.io/aquasec/tracee:0.12.0 (embedded eBPF CO-RE obj with BTFHUB support)
• docker pull docker.io/aquasec/tracee:full-0.12.0 (compiles non CO-RE eBPF object on startup)

commit log

• refactor: simplify output flags by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2700
• chore: generate k8s statics by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2703
• tracee: fix filters by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2720
• flags: remove cache-events from output help by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2729
• swap uint and containers equality order by @geyslan in https://github.com/aquasecurity/tracee/pull/2726
• types: upgrade go-yaml by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2719
• dep: update githuhub.com/aquasecrity/tracee/types by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2730
• ebpf: add prog_override_return arg to bpf_attach by @roikol in https://github.com/aquasecurity/tracee/pull/2560
• build(deps): bump github.com/containerd/containerd from 1.6.15 to 1.6.18 by @dependabot in https://github.com/aquasecurity/tracee/pull/2732
• filterscopes: create a filterscopes pkg by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2738
• log when not a container cgroup instead of err by @geyslan in https://github.com/aquasecurity/tracee/pull/2737
• pkg/ebpf: add derived events for ld SO symbols collision (rebase) by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2740
• sign container images with cosign by @developer-guy in https://github.com/aquasecurity/tracee/pull/2607
• chore: bump golang.org/x/net from 0.5.0 to 0.7.0 by @dependabot in https://github.com/aquasecurity/tracee/pull/2741
• trace: add hidden kernel module struct by @OriGlassman in https://github.com/aquasecurity/tracee/pull/2742
• adjust recently merged symbols_collision event and better document it by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2743
• refactor: rules renamed to signatures by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2715
• logger: set libbpfgo logger callback by @geyslan in https://github.com/aquasecurity/tracee/pull/2663
• events: print seconds of timespec by @roikol in https://github.com/aquasecurity/tracee/pull/2712
• ebpf: save_args_to_submit_buf minor format change by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2755
• types: add event metadata by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2752
• events: add vfs_utimes event by @roikol in https://github.com/aquasecurity/tracee/pull/2690
• Provide Fluent Forward output option by @patrick-stephens in https://github.com/aquasecurity/tracee/pull/2155
• chore (tests): add e2e instrumentation tests by @roikol in https://github.com/aquasecurity/tracee/pull/2764
• Refactor output forward flag by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2766
• feat: add do_truncate event by @roikol in https://github.com/aquasecurity/tracee/pull/2749
• Add signature event metadata by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2753
• tracee: fix args on signatures events by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2713
• tests: fix integration pkg race conditions by @geyslan in https://github.com/aquasecurity/tracee/pull/2768
• test: fix flaky TestFindingToEvent by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2774
• workflow: move runners to jenkins by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2776
• errors: improve error output by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2773
• flags: cli: docs: rename trace flag to filter by @geyslan in https://github.com/aquasecurity/tracee/pull/2767
• libbpfgo: set libbpfgo callbacks by @geyslan in https://github.com/aquasecurity/tracee/pull/2761
• signatures: load sigs as default events by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2779
• tracee: make it the default binary by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2777
• Add multiple printers by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2746
• Add file modification event by @roikol in https://github.com/aquasecurity/tracee/pull/2780
• Add webhook printer by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2782
• k8s: remove flag everythingIsAnEvent from helm by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2785
• Improve building docs by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2787
• printer: block instead of drop events for broadcast by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2789
• k8s: fix templates to use unified binary by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2786
• k8s: bump version by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2791
• k8s: remove falcosidekiq yaml by @josedonizetti in https://github.com/aquasecurity/tracee/pull/2795
• documentation: add syscall events markdown files from ChatGPT by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2792
• gptdocs: add option to generate docs for a list of events by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2800
• sets: default set can't have network events v419 by @rafaeldtinoco in https://github.com/aquasecurity/tracee/pull/2771
• adding promtail tutorial by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/2781
• docs: restructure #2788 by @AnaisUrlichs in https://github.com/aquasecurity/tracee/pull/2797
• docs: update output docs by @itaysk in https://github.com/aquasecurity/tracee/pull/2802

New Contributors

• @developer-guy made their first contribution in https://github.com/aquasecurity/tracee/pull/2607
• @patrick-stephens made their first contribution in https://github.com/aquasecurity/tracee/pull/2155

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.11.1...v0.12.0