Tracee v0.20.0 Released!

[yanivagman]

In this release, we've made significant improvements and bug fixes to enhance Tracee's capabilities. Here are some highlights:

🚀 What's New? 🚀

🌐 Network tracing enhancements

• Network events now include packet metadata type and packet direction information.
• Tracee now keeps an internal DNS Cache which is available as a datasource for events logic and signatures.
• Introduced net_tcp_connect higher-level network event, that traces a network connection including DNS information.
• introduced net_flow_tcp_begin event, that is used to track TCP connections from the start.

🦄 Miscellaneous

• Webhook output template now supports Sprig functions for dynamic data handling.
• Improve performance of calculating binary hashes (exec-hash)
• Process Tree information objects now include timestamps for better event timing accuracy.

🛠️ Fixes

• Resolve issue where Tracee fails to load in kernels >= 6.6.
• Fixed "hidden kernel module" issue which caused a BPF_LOG_ID_UNSPEC error message.
• Addressed the issue where JSON output occasionally contained invalid timestamps, resulting in bogus or negative numbers in certain events.
• Ensured that the creation of the tracee.pid file occurs under the provided installation path specified in the configuration file.
• Fixed issue with network header pointers calculation.
• Many more small fixes, check out the full commit log for more