Alternatives to Tracee
A Linux runtime security and forensics tool that traces system events using eBPF. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Tracee
A Linux runtime security and forensics tool that traces system events using eBPF.
Replacements
Listings that take over the same core job as Tracee.
Falco
Detect unusual runtime behavior on Linux systems.
Falco detects unusual runtime behaviour on Linux by applying rules to system events and container context, under the Apache-2.0 license.
Tetragon
An eBPF-based security observability and runtime enforcement tool for Linux hosts and Kubernetes clusters.
Tetragon is also eBPF-based but adds real-time kernel-level enforcement and Kubernetes-aware events with pre-defined policy libraries, aimed mainly at Kubernetes environments.
Also worth comparing
These listings name Tracee as their own alternative, so the relationship runs both ways.
Inspektor Gadget
eBPF-based tools for inspecting and debugging Kubernetes clusters and Linux hosts.
Tracee uses eBPF to trace Linux hosts and containers with built-in security detectors, aimed more at runtime security and forensics.
sysdig
A Linux command-line tool for exploring and troubleshooting systems by capturing system calls, with container support.
Tracee traces system events with eBPF and adds built-in security detectors, suiting runtime security and forensics more than general troubleshooting.
Similar software
Related functionality, not a direct replacement.
Sysmon
A Sysinternals service that logs detailed process, network and file activity to the Windows event log.
Kubescape
Assess Kubernetes configuration and runtime security.
Wazuh Agent
Endpoint agent that feeds a Wazuh server with security and compliance data.
gVisor
An application kernel that sandboxes containers to isolate them from the host Linux kernel.
Velociraptor
Endpoint monitoring and digital forensics platform driven by a query language.
