Tracee v0.6.0 released!

[grantseltzer]

See release for full change-log: https://github.com/aquasecurity/tracee/releases/tag/v0.6.0

Breaking changes

Tracee-eBPF events now show the absolute timestamp. Relative time (old behavior) can be chosen with the flag --output option:monotonic-time

Notable changes

• Tracee is now more portable thanks to CO:RE. This means that on supporting operating systems, you no longer need to compile the eBPF probe, or provide kernel-headers. See the documentation for more info: https://aquasecurity.github.io/tracee/v0.6.0/install/ebpf-compilation/.
• Tracee-eBPF can now captures network activity. See the updated documentation on capturing artifacts: https://aquasecurity.github.io/tracee/v0.6.0/tracee-ebpf/capture/.
• Cool new logo
• New/improved Tracee-eBPF events:
  • sched_process_exec
  • security_kernel_read_file
  • magic_write

Notable fixes

• Performance improvements
• Fixed loading on kernels <5.2
• Reverse shell signature works (fixed regression recently introduced)
• Tracee-eBPF gracefully stops on SIGTERM (thanks @josedonizetti )