Tracee Files

Docker Image

• docker pull docker.io/aquasec/tracee:0.24.0

Docker Images (per architecture)

• docker pull docker.io/aquasec/tracee:x86_64-0.24.0
• docker pull docker.io/aquasec/tracee:aarch64-0.24.0

What's Changed

• chore(deps): bump github.com/spf13/viper from 1.18.2 to 1.19.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4539
• chore(deps): bump github.com/docker/docker from 26.1.5+incompatible to 27.5.1+incompatible by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4549
• chore(deps): bump sigstore/cosign-installer from 3.7.0 to 3.8.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4576
• chore(deps): bump golang.org/x/sys from 0.28.0 to 0.30.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4577
• chore(deps): bump tj-actions/changed-files from 45.0.6 to 45.0.7 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4575
• chore(deps): bump squidfunk/mkdocs-material from 9.5.50 to 9.6.4 in /builder by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4584
• chore(deps): bump azure/setup-helm from 4.2.0 to 4.3.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4596
• chore(deps): bump golang from 1.23.5 to 1.24.0 in /builder by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4587
• chore(deps): bump github.com/prometheus/client_golang from 1.20.2 to 1.21.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4602
• chore(deps): bump squidfunk/mkdocs-material from 9.6.4 to 9.6.5 in /builder by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4608
• chore(deps): bump google.golang.org/protobuf from 1.36.3 to 1.36.5 in /api by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4613
• chore(deps): bump google.golang.org/protobuf from 1.36.3 to 1.36.5 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4609
• chore(deps): bump google.golang.org/grpc from 1.69.4 to 1.70.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4612
• chore(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4610
• fix(ci): CodeQL warning by @geyslan in https://github.com/aquasecurity/tracee/pull/4617
• fix(ci): CodeQL warning (2) by @geyslan in https://github.com/aquasecurity/tracee/pull/4618
• chore(deps): bump sigstore/cosign-installer from 3.8.0 to 3.8.1 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4619
• chore(deps): bump google.golang.org/grpc from 1.69.4 to 1.70.0 in /api by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4620
• Bump lint tools versions by @geyslan in https://github.com/aquasecurity/tracee/pull/4616
• chore(deps): bump github.com/google/go-cmp from 0.6.0 to 0.7.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4623
• chore(deps): bump github.com/IBM/fluent-forward-go from 0.2.2 to 0.3.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4622
• fix: replace data filter for reset event by @rscampos in https://github.com/aquasecurity/tracee/pull/4624
• feat(events): add open_file_ns and open_file_mount events by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4570
• Bump Go to 1.24 by @geyslan in https://github.com/aquasecurity/tracee/pull/4615
• chore(go): bump go.mod to use latest pkgs by @geyslan in https://github.com/aquasecurity/tracee/pull/4626
• chore(go): bump to use latest signatures/helpers by @geyslan in https://github.com/aquasecurity/tracee/pull/4628
• chore(deps): bump k8s.io/cri-api from 0.30.1 to 0.32.2 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4629
• fix(ebpf): profile only common events by @geyslan in https://github.com/aquasecurity/tracee/pull/4631
• chore(api): rename event to zeroed_inode by @rscampos in https://github.com/aquasecurity/tracee/pull/4636
• fix: filldir64 event by @rscampos in https://github.com/aquasecurity/tracee/pull/4588
• chore(deps): bump github.com/containerd/containerd from 1.7.25 to 1.7.26 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4632
• chore(deps): bump squidfunk/mkdocs-material from 9.6.5 to 9.6.7 in /builder by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4637
• chore(ci): diminish dependabot frequency... by @geyslan in https://github.com/aquasecurity/tracee/pull/4647
• Add bear rule to Makefile by @geyslan in https://github.com/aquasecurity/tracee/pull/4630
• refactor(containers): split cgroup to container map by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4604
• chore(deps): bump golang.org/x/sys from 0.30.0 to 0.31.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4651
• chore(deps): bump sigs.k8s.io/controller-runtime from 0.18.2 to 0.20.3 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4652
• chore(api): add missing event ids by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4654
• chore(ci): disable action by @geyslan in https://github.com/aquasecurity/tracee/pull/4657
• chore(deps): bump golang.org/x/net from 0.33.0 to 0.36.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4653
• chore(deps): bump golang.org/x/net from 0.33.0 to 0.36.0 in /api by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4658
• chore(deps): bump squidfunk/mkdocs-material from 9.6.7 to 9.6.9 in /builder by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4660
• chore(deps): bump docker/login-action from 3.3.0 to 3.4.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4664
• chore(deps): bump github.com/grafana/pyroscope-go from 1.2.0 to 1.2.1 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4661
• chore(deps): bump github.com/spf13/viper from 1.19.0 to 1.20.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4663
• fix(tests): handle tracee pids correctly by @geyslan in https://github.com/aquasecurity/tracee/pull/4666
• chore(deps): bump github.com/containerd/containerd from 1.7.26 to 1.7.27 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4665
• Tidy documentation by @ShohamBit in https://github.com/aquasecurity/tracee/pull/4639
• chore(grpc): update translation table by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4668
• chore(api): add security_task_prctl event ID by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4669
• chore(deps): bump google.golang.org/protobuf from 1.36.5 to 1.36.6 in /api by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4671
• chore(ci): dependabot gomod for sec updates only by @geyslan in https://github.com/aquasecurity/tracee/pull/4680
• [dependabot][github-actions] - bump actions/setup-python from 5.4.0 to 5.5.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4681
• chore(go): bump toolchain to go1.24.1 - 1st by @geyslan in https://github.com/aquasecurity/tracee/pull/4685
• chore(go): bump toolchain to go1.24.1 - 2nd by @geyslan in https://github.com/aquasecurity/tracee/pull/4686
• chore: bump toolchain to go1.24.1 - 3rd by @geyslan in https://github.com/aquasecurity/tracee/pull/4687
• fix(libcap): bump libcap to v1.2.75 & libpsx to v1.2.76-rc1 by @geyslan in https://github.com/aquasecurity/tracee/pull/4688
• [dependabot][docker] - Bump squidfunk/mkdocs-material from 9.6.9 to 9.6.10 in /builder by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4689
• Introduce evt trigger by @geyslan in https://github.com/aquasecurity/tracee/pull/4414
• [dependabot][gomod-security] - Bump google.golang.org/grpc from 1.70.0 to 1.71.1 in /api by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4693
• [dependabot][gomod-security] - Bump google.golang.org/grpc from 1.70.0 to 1.71.1 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4692
• chore(k8s): prepare v0.23.1 release by @geyslan in https://github.com/aquasecurity/tracee/pull/4696
• add traceectl to tracee by @ShohamBit in https://github.com/aquasecurity/tracee/pull/4396
• feat(trace): data field decoding types by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4699
• feat!: separate data field decoding types by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4353
• fix: add toolchain by @rscampos in https://github.com/aquasecurity/tracee/pull/4705
• feat: add heartbeat event by @AshishNaware in https://github.com/aquasecurity/tracee/pull/4650
• fix(ebpf): sockaddr_un length by @geyslan in https://github.com/aquasecurity/tracee/pull/4634
• [dependabot][gomod-security] - Bump kernel.org/pub/linux/libs/security/libcap/cap from 1.2.75 to 1.2.76 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4708
• [dependabot][gomod-security] - Bump golang.org/x/net from 0.36.0 to 0.38.0 in the golang group across 1 directory by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4712
• [dependabot][gomod-security] - Bump the golang group across 2 directories with 1 update by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4717
• [dependabot][docker] - Bump squidfunk/mkdocs-material from 9.6.10 to 9.6.12 in /builder by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4715
• [dependabot][docker] - Bump golang from 1.24.0 to 1.24.2 in /builder by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4701
• chore(deps): bump golang.org/x/net from 0.28.0 to 0.38.0 in /cmd/traceectl by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4711
• [dependabot][gomod-security] - Bump github.com/prometheus/client_golang from 1.21.0 to 1.22.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4703
• [dependabot][gomod-security] - Bump github.com/mennanov/fmutils from 0.3.0 to 0.3.1 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4716
• chore(deps): bump go toolchain to 1.24.2 by @geyslan in https://github.com/aquasecurity/tracee/pull/4718
• [dependabot][gomod-security] - Bump github.com/grafana/pyroscope-go from 1.2.1 to 1.2.2 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4709
• chore: add dependabot config for traceectl by @geyslan in https://github.com/aquasecurity/tracee/pull/4719
• [dependabot][github-actions] - Bump sigstore/cosign-installer from 3.8.1 to 3.8.2 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4720
• [dependabot][gomod-security] - Bump github.com/docker/docker from 28.0.0+incompatible to 28.1.1+incompatible by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4723
• chore: reduce dependabot noise by @geyslan in https://github.com/aquasecurity/tracee/pull/4728
• [dependabot][gomod-security] - Bump k8s.io/cri-api from 0.32.2 to 0.32.3 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4721
• [dependabot][gomod-security] - Bump github.com/urfave/cli/v2 from 2.27.5 to 2.27.6 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4722
• [dependabot][gomod-security] - Bump google.golang.org/grpc from 1.71.1 to 1.72.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4724
• [dependabot][gomod-security] - Bump sigs.k8s.io/controller-runtime from 0.20.3 to 0.20.4 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4725
• [dependabot][gomod-security] - Bump google.golang.org/grpc from 1.67.0 to 1.72.0 in /cmd/traceectl by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4727
• [dependabot][gomod-security] - Bump google.golang.org/grpc from 1.71.1 to 1.72.0 in /api by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4726
• [dependabot][gomod-security] - Bump k8s.io/api from 0.32.1 to 0.32.4 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4729
• chore(go): bump to use latest types by @geyslan in https://github.com/aquasecurity/tracee/pull/4730
• chore(go): bump to use latest inner dependencies by @geyslan in https://github.com/aquasecurity/tracee/pull/4731
• fix: ebpf max inst limit by @rscampos in https://github.com/aquasecurity/tracee/pull/4710
• Decode fixes by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4733
• [dependabot][github-actions] - Bump actions/setup-python from 5.5.0 to 5.6.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4740
• [dependabot][gomod-security] - Bump github.com/spf13/viper from 1.19.0 to 1.20.1 in /cmd/traceectl by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4741
• chore(go.mod): bump types to 386881 by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4734
• fix(traceectl): fix printer process field access by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4743
• More decode fixes by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4745
• feat(ebpf): add security_sb_umount event by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4569
• [dependabot][gomod-security] - bump github.com/aquasecurity/table from 1.8.0 to 1.10.0 in /cmd/traceectl by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4747
• [dependabot][gomod-security] - bump github.com/spf13/cobra from 1.8.1 to 1.9.1 in /cmd/traceectl by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4748
• Enable man/markdown pair changes check by @geyslan in https://github.com/aquasecurity/tracee/pull/4753
• [dependabot][docker] - bump golang from 1.24.2 to 1.24.3 in /builder by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4757
• [dependabot][docker] - bump squidfunk/mkdocs-material from 9.6.12 to 9.6.13 in /builder by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4758
• [dependabot][gomod-security] - bump golang.org/x/sys from 0.32.0 to 0.33.0 by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4755
• perf(ebpf): improve decodeEvents by @geyslan in https://github.com/aquasecurity/tracee/pull/4750
• Revert "fix(decoder): treat abstract socket in decoder" by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4772
• fix(signatures): regex of K8SServiceAccountToken by @geyslan in https://github.com/aquasecurity/tracee/pull/4760
• chore(ci): remove dependabot config file by @geyslan in https://github.com/aquasecurity/tracee/pull/4778
• Revert sockaddrun ebpf size handle by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4779
• fix(printer): broadcast if a printer is set by @geyslan in https://github.com/aquasecurity/tracee/pull/4751
• fix(utils): avoid memory retention by copying strs by @geyslan in https://github.com/aquasecurity/tracee/pull/4762
• Check probes support by @geyslan in https://github.com/aquasecurity/tracee/pull/4746
• echo AWS region by @maxiitc in https://github.com/aquasecurity/tracee/pull/4784
• chore(ci): install Go for CodeQL by @geyslan in https://github.com/aquasecurity/tracee/pull/4785
• feat(flags): reintroduce containers flag by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4714
• chore(ci): restrict codeql trigger by @geyslan in https://github.com/aquasecurity/tracee/pull/4786
• Memory profile improvements by @trvll in https://github.com/aquasecurity/tracee/pull/4787
• fix(ci): github actions do not support yaml anchor by @geyslan in https://github.com/aquasecurity/tracee/pull/4788
• chore(ci): remove test action by @geyslan in https://github.com/aquasecurity/tracee/pull/4790
• Always run codeql by @geyslan in https://github.com/aquasecurity/tracee/pull/4791
• General syncs by @geyslan in https://github.com/aquasecurity/tracee/pull/4793
• chore(deps): bump libbpfgo to v0.9.0-libbpf-1.5.1 by @geyslan in https://github.com/aquasecurity/tracee/pull/4805
• chore: introduce tracee runtime scripts by @geyslan in https://github.com/aquasecurity/tracee/pull/4792
• fix(engine): feedback deadlock issues by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4803
• Minor analyze fixes by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4806
• Container flag fixes by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4809
• chore(go.mod): bump types to 3fa6c15acc67 (#4806) by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4808
• Revert "chore(ebpf): update MAX_BYTES_ARR_SIZE const" by @geyslan in https://github.com/aquasecurity/tracee/pull/4811
• chore(build): use multiarch dir when available by @geyslan in https://github.com/aquasecurity/tracee/pull/4812
• feat(ci): add pr-sync GitHub Action by @geyslan in https://github.com/aquasecurity/tracee/pull/4814
• fix(ci): pr-sync workflow by @geyslan in https://github.com/aquasecurity/tracee/pull/4815
• chore(ci): curl max time configurable via env by @geyslan in https://github.com/aquasecurity/tracee/pull/4816
• fix(tests): ensure TestLogs goroutine is closed by @geyslan in https://github.com/aquasecurity/tracee/pull/4795
• feat(ci): add ref option to PR action by @geyslan in https://github.com/aquasecurity/tracee/pull/4813
• fix(ebpf): accept4 save remote address/port by @djoreilly in https://github.com/aquasecurity/tracee/pull/4798
• chore(build): introduce BUILD_TYPE_FLAG by @geyslan in https://github.com/aquasecurity/tracee/pull/4794
• fix integration tests and related by @geyslan in https://github.com/aquasecurity/tracee/pull/4801
• feat(utils/proc): enhance namespace utilities by @yanivagman in https://github.com/aquasecurity/tracee/pull/4820
• Set default buffer pages appropriate for page size by @djoreilly in https://github.com/aquasecurity/tracee/pull/4818
• Fix signature loading by @yanivagman in https://github.com/aquasecurity/tracee/pull/4825
• Fix clang issue by @yanivagman in https://github.com/aquasecurity/tracee/pull/4824
• chore(Makefile): add go tags to build signatures. by @trvll in https://github.com/aquasecurity/tracee/pull/4827
• Use bounded loops by @geyslan in https://github.com/aquasecurity/tracee/pull/4732
• Elf package by @yanivagman in https://github.com/aquasecurity/tracee/pull/4821
• chore(ci): set lambda to pr-sync by @geyslan in https://github.com/aquasecurity/tracee/pull/4833
• feat: add --no-signatures flag for signature logic performance testing by @yanivagman in https://github.com/aquasecurity/tracee/pull/4831
• fix: resolve multiple Coverity static analysis issues by @yanivagman in https://github.com/aquasecurity/tracee/pull/4830
• fix(ci): setup git and gh by @geyslan in https://github.com/aquasecurity/tracee/pull/4834
• chore(k8s): prepare v0.23.2 release by @geyslan in https://github.com/aquasecurity/tracee/pull/4839
• chore(libbpfgo): bump to 3474da5d by @geyslan in https://github.com/aquasecurity/tracee/pull/4837
• Fast e2e by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4810
• perf: optimize signature dispatch by @yanivagman in https://github.com/aquasecurity/tracee/pull/4841
• feat(metrics): instrument pipeline channels by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4836
• Sequential engine by @yanivagman in https://github.com/aquasecurity/tracee/pull/4842
• fix(events): [2]int type presentation by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4845
• fix: network event context by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4844
• perf: reduce pipeline-channel-size default from 10000 to 1000 by @yanivagman in https://github.com/aquasecurity/tracee/pull/4843
• Optimize events pipeline by @yanivagman in https://github.com/aquasecurity/tracee/pull/4829
• fix(events/derive): prevent pointer aliasing in cached derived events by @geyslan in https://github.com/aquasecurity/tracee/pull/4850
• gitignore: add clangd files by @yanivagman in https://github.com/aquasecurity/tracee/pull/4849
• build: add BPF debug stripping option to reduce object file size by ~3MB by @yanivagman in https://github.com/aquasecurity/tracee/pull/4853
• fix(osinfo): suport more kernel formats comparisons by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4856
• feat(events): load only used probes by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4857
• chore(go): introduce go.work by @geyslan in https://github.com/aquasecurity/tracee/pull/4854
• feat: add system monitoring utilities package by @yanivagman in https://github.com/aquasecurity/tracee/pull/4859
• feat(policies): add sets support by @josedonizetti in https://github.com/aquasecurity/tracee/pull/4861
• feat: add fentry probe type by @josedonizetti in https://github.com/aquasecurity/tracee/pull/4860
• Revert "chore(go): introduce go.work (#4854)" by @yanivagman in https://github.com/aquasecurity/tracee/pull/4863
• feat: add pwd field to sched_process_exec event by @yanivagman in https://github.com/aquasecurity/tracee/pull/4848
• fix(ebpf): fix exec_test probe reset logic by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4865
• containers: add symlink resolution support to path resolver by @yanivagman in https://github.com/aquasecurity/tracee/pull/4864
• Fix events exclude docs by @josedonizetti in https://github.com/aquasecurity/tracee/pull/4874
• build: add -failfast flag to test-unit target by @yanivagman in https://github.com/aquasecurity/tracee/pull/4875
• fix: remove unneeded SYSLOG capability from base capabilities by @yanivagman in https://github.com/aquasecurity/tracee/pull/4872
• Revert "fix: remove unneeded SYSLOG capability from base capabilities" by @yanivagman in https://github.com/aquasecurity/tracee/pull/4876
• tests: increase machine size by @yanivagman in https://github.com/aquasecurity/tracee/pull/4877
• fix: improve error messages and embed manual pages in binary by @yanivagman in https://github.com/aquasecurity/tracee/pull/4870
• helm: remove old webhook config by @josedonizetti in https://github.com/aquasecurity/tracee/pull/3883
• Add security_task_prctl event by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4583
• fix: consistent time conversion for process hash calculation by @yanivagman in https://github.com/aquasecurity/tracee/pull/4873
• fix: enable Sprig functions in gotemplate output format by @yanivagman in https://github.com/aquasecurity/tracee/pull/4871
• pkg/cgroup: add userspace cgroup ID extraction utilities by @yanivagman in https://github.com/aquasecurity/tracee/pull/4879
• Imrpove docs by @yanivagman in https://github.com/aquasecurity/tracee/pull/4878
• add copilot instructions file by @yanivagman in https://github.com/aquasecurity/tracee/pull/4890
• cli: finalize rename of cri flag to containers by @yanivagman in https://github.com/aquasecurity/tracee/pull/4885
• ebpf: remove queue/cache pipeline stage and --cache flags by @yanivagman in https://github.com/aquasecurity/tracee/pull/4884
• Load infra/compatibility by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4866
• feat(probes): add map type compatibility requirement by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4895
• feat(tests): add package and specific target testing with unit tests by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4896
• fix: capture BPF objects when bpf_attach event is not selected by @yanivagman in https://github.com/aquasecurity/tracee/pull/4886
• fix(grpc): sanitize invalid UTF-8 in ProcessLineage protobuf conversion by @trvll in https://github.com/aquasecurity/tracee/pull/4894
• feat: add comprehensive code coverage with Codecov integration by @yanivagman in https://github.com/aquasecurity/tracee/pull/4882
• fix: adjust code coverage targets to realistic baseline by @yanivagman in https://github.com/aquasecurity/tracee/pull/4898
• feat(ebpf): add prog type compatibility by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4897
• fix: resolve Codecov 'missing base commit' issue by @yanivagman in https://github.com/aquasecurity/tracee/pull/4899
• chore: remove .ONESHELL from recipes by @geyslan in https://github.com/aquasecurity/tracee/pull/4900
• Improve man command by @yanivagman in https://github.com/aquasecurity/tracee/pull/4883
• perf: replace parallel signature engine with sequential processing by @yanivagman in https://github.com/aquasecurity/tracee/pull/4846
• refactor: merge UInt and Int filters using generics by @yanivagman in https://github.com/aquasecurity/tracee/pull/4881
• Load infra/map autocreate by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4893
• Relocate common code by @geyslan in https://github.com/aquasecurity/tracee/pull/4851
• chore(deps): update common module version by @geyslan in https://github.com/aquasecurity/tracee/pull/4901
• Add additional packages under common by @yanivagman in https://github.com/aquasecurity/tracee/pull/4902
• fix:(ebpf): 'and' bitwise bug in save_bytes_to_buf by @geyslan in https://github.com/aquasecurity/tracee/pull/4904
• build: remove local common module replace directive by @yanivagman in https://github.com/aquasecurity/tracee/pull/4905
• docs: remove redundant 'Events' from built-in events navigation by @yanivagman in https://github.com/aquasecurity/tracee/pull/4906
• chore(ebpf): check for CONFIG_X86_FRED by @geyslan in https://github.com/aquasecurity/tracee/pull/4713
• docs: add missing protobuf and gRPC sections to adding-events guide by @yanivagman in https://github.com/aquasecurity/tracee/pull/4909
• fix(ebpf): use u32 for read_size in save_bytes_to_buf by @geyslan in https://github.com/aquasecurity/tracee/pull/4911
• Refactor: move signatures/helpers functions to appropriate modules (Phase 1) by @yanivagman in https://github.com/aquasecurity/tracee/pull/4907
• build: upgrade Clang toolchain from 14 to 19 and Alpine image from 3.19 to 3.21 by @yanivagman in https://github.com/aquasecurity/tracee/pull/4910
• refactor: remove signatures/helpers package by @yanivagman in https://github.com/aquasecurity/tracee/pull/4912
• Feat(common): Add checks for BPF LSM support by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4914
• Install deps by @yanivagman in https://github.com/aquasecurity/tracee/pull/4913
• feat: add comprehensive checkpatch system for PR validation by @yanivagman in https://github.com/aquasecurity/tracee/pull/4862
• feat(ebpf): add save_bytes_to_buf_max() function by @geyslan in https://github.com/aquasecurity/tracee/pull/4915
• fix: Add binutils-gold package to Alpine dependencies by @yanivagman in https://github.com/aquasecurity/tracee/pull/4917
• bugfix(lsm): interpret lsm file missing as not supported by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4919
• fix(grpc): sanitize invalid UTF-8 envent serilization to protobuf by @trvll in https://github.com/aquasecurity/tracee/pull/4916
• bugfix(lsm): support quotes in CONFIG_LSM by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4923
• feature(tests/inst): distinguish between fails and timeouts by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4925
• bugfix(kconfig): return value for string configs as well by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4924
• feat(ebpf): add min macro for comparing two values by @geyslan in https://github.com/aquasecurity/tracee/pull/4927
• feat!: consolidate server flags into unified --server flag by @yanivagman in https://github.com/aquasecurity/tracee/pull/4918
• feat(ebpf): add helpers to get socket from a fd by @geyslan in https://github.com/aquasecurity/tracee/pull/4929
• refactor(ebpf): streamline argument handling by @geyslan in https://github.com/aquasecurity/tracee/pull/4931
• fix(events): correct TIMESPEC_T decoded as time.Time instead of float64 by @yanivagman in https://github.com/aquasecurity/tracee/pull/4922
• chore(build): include pre and post extended makefiles if exist by @oshaked1 in https://github.com/aquasecurity/tracee/pull/4934
• Add fallback mechanism to event dependencies by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4891
• chore(ci): mirror unit and integration tests to arm64 by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4655
• ci: optimize PR workflows with conditional testing for Go modules by @yanivagman in https://github.com/aquasecurity/tracee/pull/4921
• ci: fix conditional module testing to actually skip expensive jobs by @yanivagman in https://github.com/aquasecurity/tracee/pull/4937
• feat(environment): create a test tool that check LSM program support by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4933
• docs: fix outdated references and reorganize contributing guides by @yanivagman in https://github.com/aquasecurity/tracee/pull/4932
• test: improve common module test coverage across 14 packages by @yanivagman in https://github.com/aquasecurity/tracee/pull/4936
• Feature/add LSM programs support by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4903
• test: remove flaky EpochToBootTimeNS test by @yanivagman in https://github.com/aquasecurity/tracee/pull/4940
• docs: comprehensive Tracee event documentation overhaul by @yanivagman in https://github.com/aquasecurity/tracee/pull/4920
• fix(performance): update dashboard detection for new --server flag format by @yanivagman in https://github.com/aquasecurity/tracee/pull/4942
• feat(ebpf): add bpf helper compatibility by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4941
• fix(ebpf): fix compatibility watcher by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4945
• Fix sig engine close chan by @yanivagman in https://github.com/aquasecurity/tracee/pull/4943
• fix(ebpf): use sockaddr workaround in arm64 by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4950
• Improve btfhub.sh to download only the required by @geyslan in https://github.com/aquasecurity/tracee/pull/4951
• feat(btfhub): BTF generation with parallel jobs by @geyslan in https://github.com/aquasecurity/tracee/pull/4952
• build: add FIPS 140-3 compliance support by @yanivagman in https://github.com/aquasecurity/tracee/pull/4955
• Revert [#4570] by @geyslan in https://github.com/aquasecurity/tracee/pull/4953
• fix: data race in capabilities singleton initialization by @yanivagman in https://github.com/aquasecurity/tracee/pull/4956
• fix: eliminate race condition in integration test ExpectAllEvtsEqualToOne by @yanivagman in https://github.com/aquasecurity/tracee/pull/4957
• Pin versions by @geyslan in https://github.com/aquasecurity/tracee/pull/4949
• chore: add regex for uprobe warn by @rscampos in https://github.com/aquasecurity/tracee/pull/4961
• chore: bump size value of bytes array by @rscampos in https://github.com/aquasecurity/tracee/pull/4964
• chore: add helper function to register event derivation by @rscampos in https://github.com/aquasecurity/tracee/pull/4965
• chore: add helper function to register probe group by @rscampos in https://github.com/aquasecurity/tracee/pull/4963
• chore: refactor getSelfLoadedPrograms log other types by @rscampos in https://github.com/aquasecurity/tracee/pull/4966
• ARM64 integration fixes by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4958
• tests: remove flaky GetSymbolOffset test and add dedicated unit test by @yanivagman in https://github.com/aquasecurity/tracee/pull/4968
• chore: update tracee/api to 3e47b0c6 by @geyslan in https://github.com/aquasecurity/tracee/pull/4959
• chore: re-add Dependabot config file by @geyslan in https://github.com/aquasecurity/tracee/pull/4960
• chore: add helper function to register signal by @rscampos in https://github.com/aquasecurity/tracee/pull/4962
• chore(ci): disable dependabot gomod updates by @geyslan in https://github.com/aquasecurity/tracee/pull/4972
• feat(metrics): set cfg.MetricsEnabled by @geyslan in https://github.com/aquasecurity/tracee/pull/4973
• feat(ebpf): add extension to Tracee by @rscampos in https://github.com/aquasecurity/tracee/pull/4930
• chore: core uprobe improvements by @rscampos in https://github.com/aquasecurity/tracee/pull/4967
• build(deps): bump golang.org/x/oauth2 from 0.26.0 to 0.27.0 in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4971
• build(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.4.0 in /cmd/traceectl in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4976
• build(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.4.0 in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/4977
• feat(initialize): refactor libbpf log logic by @geyslan in https://github.com/aquasecurity/tracee/pull/4975
• chore(tests): minimize controlplane test dependencies by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4978
• Fix unit tests by @yanivagman in https://github.com/aquasecurity/tracee/pull/4981
• Fix tracee man for signatures by @yanivagman in https://github.com/aquasecurity/tracee/pull/4980
• fix: set restrictive permissions (0600) on gRPC Unix socket by @yanivagman in https://github.com/aquasecurity/tracee/pull/4983
• chore: Add testing guide to cursor rules and ignore personal rules by @yanivagman in https://github.com/aquasecurity/tracee/pull/4954
• tests: increase derived events coverage by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4979
• feat(elf): handle tail strings in symbol matching by @geyslan in https://github.com/aquasecurity/tracee/pull/4984
• chore(deps): bump tracee/common to a5944135 by @geyslan in https://github.com/aquasecurity/tracee/pull/4988
• fix(ebpf): write clamped size to buffer metadata by @geyslan in https://github.com/aquasecurity/tracee/pull/4985
• chore(make): remove not used signatures go tags from makefile. by @trvll in https://github.com/aquasecurity/tracee/pull/4991
• chore(make): add go modules exclude list for make go-tidy by @trvll in https://github.com/aquasecurity/tracee/pull/4992
• fix(events): fix false positive of hooked_syscall by @OriGlassman in https://github.com/aquasecurity/tracee/pull/4990
• Generate artifacts for instrumentation test failure by @AlonZivony in https://github.com/aquasecurity/tracee/pull/4939
• API Improvements: Event Schema and Semantic Clarifications by @yanivagman in https://github.com/aquasecurity/tracee/pull/4989
• pkg: reorganize data structures under pkg/datastores/ by @yanivagman in https://github.com/aquasecurity/tracee/pull/4997
• feat(tests): create integration test for fallbacks and compatibility by @NDStrahilevitz in https://github.com/aquasecurity/tracee/pull/4986
• refactor(metrics): consolidate BPF perf event stats by @geyslan in https://github.com/aquasecurity/tracee/pull/4994
• fix(printer): properly close output files to prevent data loss by @yanivagman in https://github.com/aquasecurity/tracee/pull/4998
• fix(grpc): correct event field mappings in protobuf conversion by @yanivagman in https://github.com/aquasecurity/tracee/pull/5001
• fix and optimize build targets by @geyslan in https://github.com/aquasecurity/tracee/pull/5005
• feat(common/fileutil): add IsRegularFile function by @geyslan in https://github.com/aquasecurity/tracee/pull/5013
• feat(scripts/checkpatch): add BASE_REF env var by @geyslan in https://github.com/aquasecurity/tracee/pull/5014
• fix(ci): consider all tests on workflow_dispatch by @geyslan in https://github.com/aquasecurity/tracee/pull/5016
• fix(build): use tags for signatures build by @geyslan in https://github.com/aquasecurity/tracee/pull/5015
• api: rename Container.is_running to Container.started by @yanivagman in https://github.com/aquasecurity/tracee/pull/5010
• close engine output chan only when finished by @geyslan in https://github.com/aquasecurity/tracee/pull/5030
• build(deps): bump github.com/containerd/containerd from 1.7.27 to 1.7.29 in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/5019
• build(deps): bump github.com/opencontainers/selinux from 1.11.0 to 1.13.0 in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/aquasecurity/tracee/pull/5032
• ebpf: cache prev_comm in load_elf_phdrs for accurate sched_process_exec by @yanivagman in https://github.com/aquasecurity/tracee/pull/5028
• fix(events/sorting): prevent deadlock in concurrent event sending by @geyslan in https://github.com/aquasecurity/tracee/pull/5020
• Refactor of scripts/lib by @geyslan in https://github.com/aquasecurity/tracee/pull/5026
• fix(ci): update script sourcing in pr-sync.yaml by @geyslan in https://github.com/aquasecurity/tracee/pull/5033
• improve e2e tests reliability, fixes proc and proctree... by @geyslan in https://github.com/aquasecurity/tracee/pull/4995
• feat(tests): implement core and extended E2E framework by @geyslan in https://github.com/aquasecurity/tracee/pull/5036
• feat: extend tails for extensions & ... by @geyslan in https://github.com/aquasecurity/tracee/pull/5041
• fix(go.mod): update api and common deps to v0.0.0 by @geyslan in https://github.com/aquasecurity/tracee/pull/5042
• chore(k8s): prepare v0.24.0 release by @geyslan in https://github.com/aquasecurity/tracee/pull/5043

New Contributors

• @AshishNaware made their first contribution in https://github.com/aquasecurity/tracee/pull/4650
• @maxiitc made their first contribution in https://github.com/aquasecurity/tracee/pull/4784
• @trvll made their first contribution in https://github.com/aquasecurity/tracee/pull/4787
• @djoreilly made their first contribution in https://github.com/aquasecurity/tracee/pull/4798

Full Changelog: https://github.com/aquasecurity/tracee/compare/v0.23.0...v0.24.0