TRACEESHARK

Summary from the TLDR InfoSec newsletter

Traceeshark allows users to do Linux runtime security monitoring and advanced system tracing using Wireshark. It also has the ability to capture events using Tracee directly from Wireshark and have them stream in like a network capture. This can be done either locally on a Linux machine running Wireshark, semi-locally using Docker Desktop's VM on Windows and Mac, or even remotely over SSH.