Tracee v0.6.4 released!

[grantseltzer]

v0.6.4 is here! This release contains many optimizations, cleanups, documentation improvements, and bug fixes. See release for full change-log: https://github.com/aquasecurity/tracee/releases/tag/v0.6.4

Breaking changes

• Removed the --security-alerts flag Remove security-alerts flag #1106

Notable changes

• Added time of container creation to tracee-ebpf events adding ctime to sched-process-exec event #1089
• Added the option to have raw arguments from various event flags, mostly for un-parsed bitmasks Add option for raw arguments from various event flags #1123
• Added capturing of loaded kernel modules add security_kernel_post_read_file and capture kernel modules #1080 init_module capture #1122
• Added socket_dup event for detecting dup of a socket

Notable fixes

• Fixed a bug where tracing a combination of certain evens would cause "invalid arg" output tracee-ebpf: fix events sent in parallel to raw_sys_exit event #1139
• Fixed building on arm64
• Fixed process tree filtering
• Various verifier issues