johnfitzpatrick

- rule: Blacklisted Containers
  desc: >
    Detect the initial process started by a container that is from a list of blacklisted containers.
  condition: container_started and container and blacklisted_containers
  output: Container started is blacklisted (user=%user.name command=%proc.cmdline %container.info image=%container.image.repository:%container.image.tag)
  priority: WARNING
  tags: [container, mitre_lateral_movement]

- macro: blacklisted_containers
  condition: (container.name startswith 'k8s_actor_actor')

johnfitzpatrick

this is a test

johnfitzpatrick

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    component: kube-apiserver
    tier: control-plane
  name: kube-apiserver
  namespace: kube-system
spec:

johnfitzpatrick

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: carts-db
  labels:
    name: carts-db
  namespace: sock-shop
spec:
  replicas: 1
  template:

johnfitzpatrick

apiVersion: v1
kind: ConfigMap
metadata:
  name: sysdig-agent
data:
  dragent.yaml: |
    configmap: true
    ### Agent tags
    # tags: linux:ubuntu,dept:dev,local:nyc

johnfitzpatrick

swagger: '2.0'
info:
  description: Vitals API
  version: 2.4.0
  title: Vitals API
basePath: /
tags:
  - name: health
    description: Stats about the health of a Kong cluster
  - name: traffic