From c45d8dc34ff2d69a007a4e5589da3423e08befe0 Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 16 Apr 2020 16:16:58 -0700 Subject: [PATCH] remove k8s from manifest objects --- detections/kubernetes_aws_scan_fingerprint.yml | 6 +++--- detections/kubernetes_gcp_scan_fingerprint_attack.yml | 6 +++--- detections/kubernetes_pods_aws_scan_fingerprint.yml | 4 ++-- spec/v2/detections.spec.json | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/detections/kubernetes_aws_scan_fingerprint.yml b/detections/kubernetes_aws_scan_fingerprint.yml index 496de68da7..801fddcc9e 100644 --- a/detections/kubernetes_aws_scan_fingerprint.yml +++ b/detections/kubernetes_aws_scan_fingerprint.yml @@ -13,11 +13,11 @@ detect: splunk: correlation_rule: notable: - nes_fields: src_ip, k8s_cluster_name, http_user_agent + nes_fields: src_ip, cluster_name, http_user_agent rule_description: This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster in AWS rule_title: Amazon EKS Kubernetes cluster scan detection risk: - risk_object: k8s_cluster_name + risk_object: cluster_name risk_object_type: - other risk_score: 70 @@ -30,7 +30,7 @@ detect: search: 'sourcetype="aws:cloudwatchlogs:eks" "user.username"="system:anonymous" userAgent!="AWS Security Scanner" | rename sourceIPs{} as src_ip | stats count min(_time) as firstTime max(_time) as lastTime values(responseStatus.reason) values(source) as cluster_name values(responseStatus.code) values(userAgent) as http_user_agent values(verb) values(requestURI) by src_ip user.username user.groups{} | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` |`kubernetes_aws_scan_fingerprint_detection`' eli5: In this search we can detect unauthenticated web requests against an EKS cluster, by looking at k8s authentication data, user agent and source IPs. entities: - - k8s_cluster_name + - cluster_name - src_ip how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudWatch EKS Logs diff --git a/detections/kubernetes_gcp_scan_fingerprint_attack.yml b/detections/kubernetes_gcp_scan_fingerprint_attack.yml index 4b3984cd7d..06f58f180a 100644 --- a/detections/kubernetes_gcp_scan_fingerprint_attack.yml +++ b/detections/kubernetes_gcp_scan_fingerprint_attack.yml @@ -17,7 +17,7 @@ detect: rule_description: Detect scanning attempts against a GCP Kubernetes cluster rule_title: GCP Kubernetes cluster scan detection risk: - risk_object: k8s_cluster_name + risk_object: cluster_name risk_object_type: - other risk_score: 70 @@ -27,10 +27,10 @@ detect: cron_schedule: 0 * * * * earliest_time: -70m@m latest_time: -10m@m - search: sourcetype="google:gcp:pubsub:message" data.protoPayload.requestMetadata.callerIp!=127.0.0.1 data.protoPayload.requestMetadata.callerIp!=::1 "data.labels.authorization.k8s.io/decision"=forbid "data.protoPayload.status.message"=PERMISSION_DENIED data.protoPayload.authenticationInfo.principalEmail="system:anonymous" | rename data.protoPayload.requestMetadata.callerIp as src_ip | stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_name values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent by src_ip data.resource.labels.cluster_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `kubernetes_gcp_scan_fingerprint_detection` + search: sourcetype="google:gcp:pubsub:message" data.protoPayload.requestMetadata.callerIp!=127.0.0.1 data.protoPayload.requestMetadata.callerIp!=::1 "data.labels.authorization.k8s.io/decision"=forbid "data.protoPayload.status.message"=PERMISSION_DENIED data.protoPayload.authenticationInfo.principalEmail="system:anonymous" | rename data.protoPayload.requestMetadata.callerIp as src_ip | stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_name values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent by src_ip data.resource.labels.cluster_name | rename data.resource.labels.cluster_name as cluster_name| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `kubernetes_gcp_scan_fingerprint_detection` eli5: In this search we can detect unauthenticated web requests and possible attack against a GCP cluster, by looking at k8s authentication data, user agent, source IPs and destionation entities: - - k8s_cluster_name + - cluster_name - src_ip how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk. You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_scan_fingerprint_attack_detection to filter out FPs. id: db5957ec-0144-4c56-b512-9dccbe7a2d26 diff --git a/detections/kubernetes_pods_aws_scan_fingerprint.yml b/detections/kubernetes_pods_aws_scan_fingerprint.yml index ed87802b3b..b23731ebc6 100644 --- a/detections/kubernetes_pods_aws_scan_fingerprint.yml +++ b/detections/kubernetes_pods_aws_scan_fingerprint.yml @@ -17,7 +17,7 @@ detect: rule_description: This search provides detection information on unauthenticated requests against Kubernetes' Pods API rule_title: Amazon EKS Kubernetes Pod scan detection risk: - risk_object: k8s_cluster_name + risk_object: cluster_name risk_object_type: - other risk_score: 70 @@ -30,7 +30,7 @@ detect: search: sourcetype="aws:cloudwatchlogs:eks" "user.username"="system:anonymous" verb=list objectRef.resource=pods requestURI="/api/v1/pods" | rename source as cluster_name sourceIPs{} as src_ip | stats count min(_time) as firstTime max(_time) as lastTime values(responseStatus.reason) values(responseStatus.code) values(userAgent) values(verb) values(requestURI) by src_ip cluster_name user.username user.groups{} | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `kubernetes_pods_aws_scan_fingerprint_detection` eli5: In this search we can detect unauthenticated web requests against an EKS cluster Pod, by looking at k8s authentication data, user agent and source IPs and API direct request. entities: - - k8s_cluster_name + - cluster_name - src_ip how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on forAWS (version 4.4.0 or later), then configure your AWS CloudWatch EKS Logs.Please also customize the `kubernetes_pods_aws_scan_fingerprint_detection` macro to filter out the false positives. id: dbfca1dd-b8e5-4ba4-be0e-e565e5d62002 diff --git a/spec/v2/detections.spec.json b/spec/v2/detections.spec.json index 63c3f37d67..593ac1d720 100644 --- a/spec/v2/detections.spec.json +++ b/spec/v2/detections.spec.json @@ -747,7 +747,7 @@ "dest_user", "url", "domain", - "k8s_cluster_name" + "cluster_name" ] }, "minItems": 0,