Tracee
Runtime security + forensics tool. Aqua Security 2020. eBPF-based syscall + kernel-event-tracing. Standalone CLI eller daemon-mode. Use cases: security-events-detection, container-forensics, incident-response.
Skiljs från Falco: Tracee mer-tool-oriented (run on-demand för forensics), Falco daemon-oriented (continuous-monitoring). Output: events + custom signatures (rules in Rego/CEL/Go). Built-in signatures för 70+ known threats. CNCF Sandbox. Integration: Aqua Security commercial-platform (Wave). Modern security: Tetragon + Falco + Tracee samma family, slightly different angles. Adoption: niche compared to Falco, but powerful för security-engineers doing-deep-investigation.