Tracee v0.21.0 Released!

[yanivagman]

Tracee v0.21.0 introduces significant enhancements, new features, and crucial bug fixes to improve clarity, performance, and functionality.

⚠️ Breaking Changes

• Context Filters Renamed to Scope Filters: The terminology "context filters" has been replaced with "scope filters" throughout the codebase and documentation.

🚀 New Features and Improvements

• Webhook Configuration without URL: Webhook configurations can now be used without specifying a URL.
• Process Tree Procfs Scan Configuration: Users can now configure the process tree feature to balance information reliability and performance.
• Optimized Init Program: Lazy ebpf program data initialization improves performance by reducing unnecessary CPU cycles.
• Security Path Notify Event: The inotify_watch event has been replaced with security_path_notify for broader compatibility and additional information.
• Global Event ID Enum: A new global event ID enum has been added to the API for easier mapping and identification of events, along with support for dynamic events with IDs above 10,000.

💎 Refinements and Bug Fixes

• Memory Usage: Fixed an issue introduced in v0.20.0 that caused increased memory consumption. Tracee now consumes up to 200MB less RSS memory.
• Refactored Event Structure: The event structure has been renamed for improved clarity and consistency, with changes to field names and structure.
• Static Build Compatibility: Ensured compatibility of static builds with zstd library in various environments.
• Execute Finished Tracepoints: Fixed the issue where execute_finished tracepoints were missing when debugfs was not accessible.
• Capture IO Content: Resolved the issue where captured files were created empty by restoring content capturing.
• Hooked Syscall Event in v6.5 Kernels: Fixed an issue with the hooked_syscall event in v6.5 kernels.
• Magic Write Performance: Optimized the magic_write event logic to reduce performance overhead.
• Analyze Mode Flags: Restored the functionality of analyze mode flags.
• Failed Execve Argv/Envp: Added a dedicated handler to display argv and envp on failed execve events.
• Security Socket Connect FD: Fixed an issue with the wrong file descriptor being sent in the security_socket_connect event.
• Sys Enter Filtering: Fixed the issue where filtering on the syscall argument of sys_enter did not work.
• Process Info Map: Resolved a warning that occurred in environments with a large number of CPUs.

For a complete list of changes and further details, please refer to the commit log.