Tracee uses eBPF technology to tap into your system and give you
access to hundreds of events that help you understand how your system behaves.

Usage:
  tracee [flags]
  tracee [command]

Available Commands:
  analyze     Analyze past events with signature events [Experimental]
  completion  Generate the autocompletion script for the specified shell
  list        List traceable events
  man         Open manual pages for tracee flags and events
  version     Print the version number of Tracee

Flags:
  -h, --help
  -s, --scope stringArray            [uid|comm|container...]		Select workloads to trace by defining filter expressions
  -e, --events stringArray           [name|name.data.pathname...]	Select events to trace and event filters
  -p, --policy stringArray           [file|dir]				Path to a policy or directory with policies
  -o, --output stringArray           [json|none|webhook...]		Control how and where output is printed (default [table])
  -c, --capture stringArray          [write|exec|network...]		Capture artifacts that were written, executed or found to be suspicious
      --config string                <file>				Global config file (yaml, json between others - see documentation)
      --containers stringArray       Configure container enrichment and runtime sockets for container events enrichment (see documentation)
      --signatures-dir stringArray   <dir>				Directories where to search for signatures in Go plugin (.so) format
  -b, --perf-buffer-size int         <size>				Size, in pages, of the internal perf ring buffer used to submit events from the kernel (default 1024)
      --blob-perf-buffer-size int    <size>				Size, in pages, of the internal perf ring buffer used to send blobs from the kernel (default 1024)
      --pipeline-channel-size int    <size>				Size, in event objects, of each pipeline stage's output channel (default 1000)
  -t, --proctree stringArray         [source=[events|signals|both]...]	Control process tree options (default [source=none])
      --dnscache stringArray         					Enable DNS Cache (default [none])
      --server stringArray           Configure server options and endpoints. Examples: http-address=:3366, grpc-address=unix:/var/run/tracee.sock, grpc (defaults to unix:/var/run/tracee.sock), metrics, healthz, pprof, pyroscope
  -C, --capabilities stringArray     [bypass|add|drop]			Define capabilities for tracee to run with
      --install-path string          <dir>				Path where tracee will install or lookup it's resources (default "/tmp/tracee")
  -l, --log stringArray              [debug|info|warn...]		Logger options (default [info])

Additional help topics:
  tracee

Use "tracee [command] --help" for more information about a command.