fixes tracee

install.sh

@@ -103,10 +103,6 @@ do
           	/usr/bin/docker pull aquasec/tracee;
              fi
           fi
-		  # Move, set & activate tracee
-		  mkdir -p /opt/detector/rulesets/tracee
-		  cp ./rulesets/tracee/tracee.sh /opt/detector/rulesets/tracee/tracee.sh
-		  bash /opt/detector/rulesets/tracee/tracee.sh
 	      ;;
         6)
 	# Honeypot Autodropper POC

rulesets/tracee/tracee.sh → rulesets/central/tracee.sh

@@ -1,13 +1,15 @@
 #!/bin/bash
 
-#Currently deactivated for testing
+# Check if Tracee exists
+tracee_present=$( /usr/bin/docker images -q tracee )
 
+#Only run if Tracee isn't running
+if [[ -n "$tracee_present" ]]; then
 docker run --name tracee --rm --pid=host --cgroupns=host --privileged -v /etc/os-release:/etc/os-release-host:ro -e LIBBPFGO_OSRELEASE_FILE=/etc/os-release-host aquasec/tracee:latest --rules TRC-2 --rules TRC-6 --rules TRC-7 --rules TRC-15 | ts '[%Y-%m-%d %H:%M:%S] module=Tracee output=' >> /var/log/detector.log & 
-
+fi
 
 # tracee-updater
-#    tracee_present=$( /usr/bin/docker images -q tracee )
-#    if [[ -n "$tracee_present" ]]; then
-#    /usr/bin/docker pull aquasec/tracee;
-#    /usr/bin/docker restart tracee;
-#    fi
+ #   if [[ -n "$tracee_present" ]]; then
+ #   /usr/bin/docker pull aquasec/tracee;
+ #   /usr/bin/docker restart tracee;
+ #   fi