sysdig

sudo sysdig -w capture.scap

Capture complete system activity (syscalls, processes, network) with sysdig to a file for forensic analysis and behavior detection.

Run it when you need total visibility into a host's behavior at a specific moment: sysdig captures every syscall, every process created, every network connection, with the latency of a system-wide strace. The resulting .scap file is analyzed later with sysdig filters (or chisels) without affecting host performance at analysis time. In an IR, capturing before acting on the compromised host gives you the full picture — processes, executions, connections — that application logs don't have. It's also the foundation of Falco, which uses the same engine for real-time detection.

Don't use it in production without planning: capturing all syscall traffic on a busy host generates huge files (GB per hour) and consumes notable CPU. On hosts with high activity, limit the capture with filters (-p, or targeted captures on specific processes/containers) or capture short windows. And watch out: sysdig only sees what happens while it's capturing — if the attacker already acted, there's nothing to see; capture is preventive (suspicious hosts, maintenance windows) or immediate upon alert detection. On kernels without required modules or in environments with strict seccomp, sysdig may fail to load.