Individual skill
Capture Linux runtime security events and suspicious behavior for live triage with Tracee
Watch live Linux and container activity through eBPF so you can triage suspicious runtime behavior before it disappears into guesswork.
skills/capture-linux-runtime-security-events-and-suspicious-behavior-for-live-triage-with-tracee/SKILL.md
Source commit fc97377adefd53e861c1d456aa1392e4a4e022a2
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Not checked yet
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
Standard SKILL.md format has not been attested at this commit. No installation command is available; inspect the source.
Repository context
- Repository stars (not skill ratings)
- 62
- Repository last updated
- Nov 9, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- ai-agents Repository topic
- claude-code Repository topic
- codex Repository topic
- cursor Repository topic
- npx-skills Repository topic
- openclaw Repository topic
- ai-tools Repository topic
- mcp Repository topic
- awesome-list Repository topic
- security Derived category
- devops Derived category
- devops-containers Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 1,540 bytes
Read excerpt
# Capture Linux runtime security events and suspicious behavior for live triage with Tracee
Watch live Linux and container activity through eBPF so you can triage suspicious runtime behavior before it disappears into guesswork.
## Prerequisites
Linux host or Kubernetes environment with the required kernel support, Tracee runtime or container image, elevated access to collect eBPF events, and access to the target system or cluster
## Installation
No source-backed install or usage instructions could be extracted automatically. Review the upstream project before running this skill in a sensitive workflow.
- Source: https://github.com/aquasecurity/tracee
