Running tracee all the time

[Harrypott2021]

Can we run tracee all the time without performance issues and can we export it into something like SIEM?

[yanivagman]

Hello @Harrypott2021

Performance is something that we work hard on to make the best we can, as can also be seen here: https://github.com/aquasecurity/tracee/issues?q=is%3Aissue+is%3Aopen+label%3Aperformance

Can we run tracee all the time without performance issues

The next version of Tracee (v0.8.2, planned to be released next week) will include some major performance improvements to sys_enter/sys_exit, which caused some performance issues. Running our own load tests with main branch showed that tracee can indeed run in the background with a small CPU overhead of ~2%.

and can we export it into something like SIEM?

Have a look here: https://aquasecurity.github.io/tracee/v0.8.1/integrating/webhook .

[itaysk]

regarding exporting to siem, I suppose you mean to collect the raw data of event? if so, this section might be relevant https://aquasecurity.github.io/tracee/v0.8.1/tracing/
let us know if this answers your question