Capture Linux runtime security events and suspicious behavior for live triage with Tracee
Watch live Linux and container activity through eBPF so you can triage suspicious runtime behavior before it disappears into guesswork.
Capture Linux runtime security events and suspicious behavior for live triage with Tracee
Watch live Linux and container activity through eBPF so you can triage suspicious runtime behavior before it disappears into guesswork.
Installation
Method 1, Agent Skill Exchange
- Install from the marketplace listing: https://agentskillexchange.com/skills/capture-linux-runtime-security-events-and-suspicious-behavior-for-live-triage-with-tracee/
Method 2, Git clone
git clone https://github.com/agentskillexchange/skills.git && cd skills/skills/capture-linux-runtime-security-events-and-suspicious-behavior-for-live-triage-with-tracee
Method 3, Download ZIP
- Download the repository ZIP and extract
skills/capture-linux-runtime-security-events-and-suspicious-behavior-for-live-triage-with-tracee.
Method 4, Manual copy
- Copy this skill folder into your local skills directory, then reload your agent tooling.
Method 5, Fork and sync
- Fork the repository if you want to maintain local edits while syncing upstream changes.