aquasecurity/tracee

Issues somebody may already be working on are listed last. List everything by date

• Cut a new release

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/feature

  Difficulty 4/5 3-5 days Newbie friendliness 35/100

  aquasecurity/tracee#5368 · 1 comment · Opened Aug 17, 2026

• Refactor/Optimise argument/data parsing (stringification)

  May be free again @geyslan claimed this 144 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/performance kind/feature

  aquasecurity/tracee#5338 · 1 comment · 1 assignee · Opened Jun 17, 2026

• Review VM_ vs PROT_ naming for mmap/mprotect-related BPF and events**

  May be free again @geyslan claimed this 200 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/bug

  aquasecurity/tracee#5295 · 1 assignee · Opened Apr 22, 2026

• ci: fast forward merges doesn't dipatch PR Sync or any other workflow

  May be free again @geyslan claimed this 201 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/bug kind/feature

  aquasecurity/tracee#5294 · 1 comment · 1 assignee · Opened Apr 22, 2026

• stack_pivot: false positives on Go 1.26 binaries due to heap base randomization

  May be free again @josedonizetti claimed this 253 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/bug

  aquasecurity/tracee#5246 · 2 comments · 1 reaction · 1 assignee · Opened Feb 28, 2026

• Container/pods filters implicitly exclude host events

  May be free again A pull request for this issue was closed without being merged. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 3/5 1-2 days Newbie friendliness 45/100

  aquasecurity/tracee#5224 · 2 comments · Opened Jan 30, 2026

• Add gRPC Health Checking Protocol support

  May be free again A pull request for this issue was closed without being merged. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/feature

  Difficulty 3/5 1-2 days Newbie friendliness 48/100

  aquasecurity/tracee#5217 · Opened Jan 28, 2026

• Tracee Test Coverage Across Distros and Kernels

  May be free again @geyslan claimed this 300 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/chore

  aquasecurity/tracee#5188 · 1 comment · 1 assignee · Opened Jan 12, 2026

• Refactor e2e (kernel, network) tests

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/chore kind/feature

  Difficulty 4/5 3-5 days Newbie friendliness 35/100

  aquasecurity/tracee#5037 · Opened Nov 12, 2025

• Add Body to net_packet_http

  May be free again A pull request for this issue was closed without being merged. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/feature

  Difficulty 4/5 3-5 days Newbie friendliness 35/100

  aquasecurity/tracee#4852 · 2 comments · Opened Jul 30, 2025

• `dst_dns` arg for the `net_tcp_connect` event is empty

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/bug

  Difficulty 3/5 1-2 days Newbie friendliness 35/100

  aquasecurity/tracee#4675 · Opened Mar 26, 2025

• Parse arguments of triggering events

  May be free again @NDStrahilevitz claimed this 628 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/feature

  aquasecurity/tracee#4601 · 3 comments · 1 assignee · Opened Feb 19, 2025

• ARM64: eBPF crashes when Tracee starts with flags `pprof` and `pyroscope`

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/bug

  Difficulty 4/5 3-5 days Newbie friendliness 30/100

  aquasecurity/tracee#4556 · 3 comments · Opened Jan 27, 2025

• Fix/create ebpf/userland types

  May be free again @geyslan claimed this 655 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/ebpf area/userspace kind/bug

  aquasecurity/tracee#4551 · 3 comments · 1 assignee · Opened Jan 23, 2025

• ParseArgs unnecessary casting leads to wrong values

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/bug

  Difficulty 4/5 3-5 days Newbie friendliness 35/100

  aquasecurity/tracee#4504 · 4 comments · 1 reaction · Opened Jan 14, 2025

• Extend In-Kernel Data Filtering for other types of filtering

  May be free again @rscampos claimed this 695 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/ebpf kind/feature

  aquasecurity/tracee#4433 · 1 assignee · Opened Dec 13, 2024

• [FEAT] tracee replay flag

  May be free again @josedonizetti claimed this 338 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/feature

  aquasecurity/tracee#4425 · 4 comments · 1 assignee · Opened Dec 12, 2024

• `symbols_loaded` and `symbols_collision` events work incorrectly with multiple policies

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/bug

  Difficulty 5/5 Over a week Newbie friendliness 30/100

  aquasecurity/tracee#4352 · 1 comment · Opened Oct 14, 2024

• Add capturing support in k8s

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/capture kind/feature

  Difficulty 5/5 Over a week Newbie friendliness 30/100

  aquasecurity/tracee#4164 · Opened Jul 1, 2024

• Refactor release build/ci process

  May be free again @geyslan claimed this 863 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/bug kind/chore

  aquasecurity/tracee#4152 · 3 comments · 1 assignee · Opened Jun 24, 2024

• Bogus packets generated by packet capture

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/capture kind/bug

  Difficulty 4/5 3-5 days Newbie friendliness 35/100

  aquasecurity/tracee#4087 · Opened May 29, 2024

• Remove policy limitations

  May be free again @yanivagman claimed this 704 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/feature

  aquasecurity/tracee#3987 · 1 assignee · Opened Apr 18, 2024

• Network events cause high CPU and latency

  May be free again @josedonizetti claimed this 935 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/bug

  aquasecurity/tracee#3986 · 1 assignee · Opened Apr 18, 2024

• Incorrect expected behavior of BPF_MAP_TYPE_LRU_HASH

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/bug

  Difficulty 4/5 3-5 days Newbie friendliness 25/100

  aquasecurity/tracee#3930 · 2 comments · Opened Mar 25, 2024

• Add support for <, > operators

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/feature

  Difficulty 3/5 1-2 days Newbie friendliness 45/100

  aquasecurity/tracee#3856 · Opened Feb 14, 2024

• Enrichment concurrency issue with control plane

  May be free again @josedonizetti claimed this 292 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/bug

  aquasecurity/tracee#3850 · 1 comment · 1 assignee · Opened Feb 7, 2024

• feature: trace HTTPS events

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/feature

  Difficulty 4/5 3-5 days Newbie friendliness 35/100

  aquasecurity/tracee#3827 · 1 comment · Opened Jan 29, 2024

• Vector files capture might use incorrect offsets

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/capture area/ebpf kind/bug

  Difficulty 4/5 3-5 days Newbie friendliness 35/100

  aquasecurity/tracee#3818 · Opened Jan 22, 2024

• TOCTOU in the eBPF path caching

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/ebpf kind/bug

  Difficulty 4/5 3-5 days Newbie friendliness 25/100

  aquasecurity/tracee#3804 · 2 comments · Opened Jan 14, 2024

• Apply capture io filters on the exec capture

  May be free again @AlonZivony claimed this 1029 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/capture kind/feature

  aquasecurity/tracee#3803 · 1 assignee · Opened Jan 14, 2024

• Support path suffix filter for captures

  May be free again @AlonZivony claimed this 1029 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/capture area/filtering kind/feature

  aquasecurity/tracee#3801 · 1 comment · 1 assignee · Opened Jan 11, 2024

• Missing capture write of ELF files documentation

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/capture kind/documentation

  Difficulty 1/5 Under an hour Newbie friendliness 50/100

  aquasecurity/tracee#3789 · Opened Jan 3, 2024

• Capture an ELF file upon mem_prot_alert

  May be free again @AlonZivony claimed this 1044 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/capture kind/feature

  aquasecurity/tracee#3787 · 1 assignee · Opened Dec 31, 2023

• Add Kubernetes filters to scopes

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/feature

  Difficulty 4/5 3-5 days Newbie friendliness 45/100

  aquasecurity/tracee#3711 · 5 comments · Opened Nov 27, 2023

• docs: Add a tutorial on forwarding Tracee logs

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/documentation

  Difficulty 2/5 1-3 hours Newbie friendliness 45/100

  aquasecurity/tracee#3703 · Opened Nov 22, 2023

• When enabling "exec-env" option, too many false positives happen

  May be free again @josedonizetti claimed this 295 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/bug

  aquasecurity/tracee#3659 · 7 comments · 1 assignee · Opened Nov 3, 2023

• docs: Rewrite Architecture Section

  May be free again @yanivagman claimed this 1014 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/documentation

  aquasecurity/tracee#3639 · 2 comments · 1 assignee · Opened Oct 31, 2023

• Symbols import event

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/events kind/feature

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  aquasecurity/tracee#3533 · Opened Oct 1, 2023

• File create high-level event

  May be free again @AlonZivony claimed this 1135 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/events kind/feature

  aquasecurity/tracee#3532 · 11 comments · 1 reaction · 1 assignee · Opened Oct 1, 2023

• Analyze mode should support same (or similar) features as regular pipeline.

  May be free again @NDStrahilevitz claimed this 818 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/rules kind/feature

  aquasecurity/tracee#3520 · 3 comments · 1 assignee · Opened Sep 28, 2023

• Writing to a process memory event

  May be free again @AlonZivony claimed this 1138 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/events kind/feature

  aquasecurity/tracee#3518 · 1 assignee · Opened Sep 28, 2023

• Chmod internal event

  May be free again @AlonZivony claimed this 1138 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/events kind/feature

  aquasecurity/tracee#3517 · 1 assignee · Opened Sep 28, 2023

• Extract Tracee package out of ebpf package

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/chore

  Difficulty 5/5 Over a week Newbie friendliness 30/100

  aquasecurity/tracee#3444 · Opened Sep 5, 2023

• Captured files IO space optimization

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/capture kind/feature

  Difficulty 5/5 Over a week Newbie friendliness 25/100

  aquasecurity/tracee#3420 · Opened Aug 27, 2023

• Unbounded disk space usage by capture feature

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/capture kind/bug

  Difficulty 5/5 Over a week Newbie friendliness 25/100

  aquasecurity/tracee#3419 · 1 comment · Opened Aug 27, 2023

• Central container for building

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 5/5 Over a week Newbie friendliness 25/100

  aquasecurity/tracee#3392 · 4 comments · Opened Aug 16, 2023

• Docs: document the release process in the contributing guidelines of the documentation

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  kind/documentation

  Difficulty 3/5 1-2 days Newbie friendliness 35/100

  aquasecurity/tracee#3377 · Opened Aug 11, 2023

• Avoid search for path in capture path filter if not filtered

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/capture area/ebpf area/performance kind/feature

  Difficulty 3/5 1-2 days Newbie friendliness 48/100

  aquasecurity/tracee#3365 · 1 reaction · Opened Aug 8, 2023

• magic_read event

  May be free again @AlonZivony claimed this 1195 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/ebpf area/events kind/feature

  aquasecurity/tracee#3358 · 1 assignee · Opened Aug 2, 2023

• Test all non-syscall events in all kernels

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  area/testing kind/feature

  Difficulty 4/5 3-5 days Newbie friendliness 35/100

  aquasecurity/tracee#3357 · 1 comment · Opened Aug 2, 2023