NAME:
   Tracee - Trace OS events and syscalls using eBPF

USAGE:
   Tracee [global options] command [command options]

VERSION:
   "v0.24.1"

COMMANDS:
   help, h  Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --list, -l                                                                 list traceable events (default: false)
   --scope value, -s value [ --scope value, -s value ]                        select workloads to trace by defining filter expressions. run '--scope help' for more info.
   --events value, -e value [ --events value, -e value ]                      select events to trace and filter events. run '--events help' for more info.
   --capture value, -c value [ --capture value, -c value ]                    capture artifacts that were written, executed or found to be suspicious. run '--capture help' for more info.
   --capabilities value, --caps value [ --capabilities value, --caps value ]  define capabilities for tracee to run with. run '--capabilities help' for more info.
   --output value, -o value [ --output value, -o value ]                      control how and where output is printed. run '--output help' for more info. (default: "format:table")
   --proctree value, -t value [ --proctree value, -t value ]                  process tree options. run '--proctree help' for more info. (default: "none")
   --dnscache value [ --dnscache value ]                                      dns cache options. run '--dnscache help' for more info (default: "none")
   --containers value [ --containers value ]                                  configure container enrichment and runtime sockets. run '--containers help' for more info.
   --perf-buffer-size value, -b value                                         size, in pages, of the internal perf ring buffer used to submit events from the kernel (default: 1024)
   --blob-perf-buffer-size value                                              size, in pages, of the internal perf ring buffer used to send blobs from the kernel (default: 1024)
   --pipeline-channel-size value                                              size, in event objects, of each pipeline stage's output channel (default: 10000)
   --install-path value                                                       path where tracee will install or lookup it's resources (default: "/tmp/tracee")
   --server value [ --server value ]                                          Configure server endpoints. Examples: http-address=:3366, metrics, healthz, pprof, pyroscope
   --log value [ --log value ]                                                logger option. run '--log help' for more info. (default: "info")
   --help, -h                                                                 show help
   --version, -v                                                              print the version