feat: Add high level overview to Readme

[simar7]

Fixes: #637

Signed-off-by: Simarpreet Singh simar@linux.com

[itaysk]

I wouldn't put this under getting started as it doesn't help the user get started. IMO the end user shouldn't even be aware of the intricacies of the internal components, only developers should. In the new readme (#647 ) this would fit under the "components" section. Appreciate if you could rebase on that PR (once merged)

[itaysk]

Actually, perhaps it would be beneficial to have an architecture.md file, for the sake of introducing contributors to tracee (as opposed to users which have the docs site). at first this doc can just contain this diagram, perhaps in the future we will add content

[itaysk]

https://matklad.github.io//2021/02/06/ARCHITECTURE.md.html

[simar7]

Yeah sure I'm OK with that. I can change it live in architecture.md instead.

[grantseltzer]

I need to try excalidraw, diagram looks great! My only comment is the "event detected" by (3). If I understand correctly all of the events are fed to tracee-rules in which case I feel 'event detected' makes more sense to be inside of tracee-rules's box.

Perhaps a better thing to put there is "flow of events created by tracee-ebpf"? And the 'events sent' from (2) should be "events created"?

[simar7]

I need to try excalidraw, diagram looks great! My only comment is the "event detected" by (3). If I understand correctly all of the events are fed to tracee-rules in which case I feel 'event detected' makes more sense to be inside of tracee-rules's box.

Perhaps a better thing to put there is "flow of events created by tracee-ebpf"? And the 'events sent' from (2) should be "events created"?

Right, how about I change it to:
(3) events collected
(4) report findings

[itaysk]

The title over the tracee-rules block should say detection, imo. Otherwise lgtm