/usr/bin/tracee-rules

NAME:
   tracee-rules - A rule engine for Runtime Security

USAGE:
   tracee-rules [global options] command [command options]

COMMANDS:
   help, h  Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --rules value [ --rules value ]                select which rules to load. Specify multiple rules by repeating this flag. Use --list for rules to select from
   --rules-dir value                              directory where to search for rules in Go plugin (.so) format
   --list                                         print all available rules (default: false)
   --webhook value                                HTTP endpoint to call for every match
   --webhook-template value                       path to a gotemplate for formatting webhook output
   --webhook-content-type value                   content type of the template in use. Recommended if using --webhook-template
   --input-tracee value [ --input-tracee value ]  configure tracee-ebpf as input source. see '--input-tracee help' for more info
   --output-template value                        configure output format via templates. Usage: --output-template=path/to/my.tmpl
   --list-events                                  print a list of events that currently loaded signatures require (default: false)
   --server value [ --server value ]              Configure server endpoints. Examples: metrics, healthz
   --allcaps                                      allow tracee-rules to run with all capabilities (use with caution) (default: false)
   --help, -h                                     show help