mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
152 lines
9.1 KiB
YAML
152 lines
9.1 KiB
YAML
name: Cisco Isovalent Process Connect
|
|
id: bf8c76a1-6066-4759-ab77-d3f0a375519e
|
|
version: 2
|
|
creation_date: '2026-01-05'
|
|
modification_date: '2026-05-13'
|
|
author: Bhavin Patel, Splunk
|
|
description: "Captures detailed process connection events—including source and destination process metadata, execution lineage (ancestry), and Kubernetes workload context—generated by Cisco Isovalent instrumentation. Enables technical analysis of inter-process communications, container-level activity, and workload-specific network flows in cloud-native environments."
|
|
source: not_applicable
|
|
sourcetype: cisco:isovalent:processConnect
|
|
supported_TA:
|
|
- name: Cisco Security Cloud
|
|
url: https://splunkbase.splunk.com/app/7404
|
|
version: 3.6.5
|
|
fields:
|
|
- _time
|
|
- app
|
|
- cluster_name
|
|
- container_id
|
|
- dest
|
|
- dest_ip
|
|
- dest_port
|
|
- eventtype
|
|
- host
|
|
- index
|
|
- linecount
|
|
- node_labels.alpha.eksctl.io/cluster-name
|
|
- node_labels.alpha.eksctl.io/nodegroup-name
|
|
- node_labels.beta.kubernetes.io/arch
|
|
- node_labels.beta.kubernetes.io/instance-type
|
|
- node_labels.beta.kubernetes.io/os
|
|
- node_labels.eks.amazonaws.com/capacityType
|
|
- node_labels.eks.amazonaws.com/nodegroup
|
|
- node_labels.eks.amazonaws.com/nodegroup-image
|
|
- node_labels.eks.amazonaws.com/sourceLaunchTemplateId
|
|
- node_labels.eks.amazonaws.com/sourceLaunchTemplateVersion
|
|
- node_labels.failure-domain.beta.kubernetes.io/region
|
|
- node_labels.failure-domain.beta.kubernetes.io/zone
|
|
- node_labels.k8s.io/cloud-provider-aws
|
|
- node_labels.kubernetes.io/arch
|
|
- node_labels.kubernetes.io/hostname
|
|
- node_labels.kubernetes.io/os
|
|
- node_labels.node.kubernetes.io/instance-type
|
|
- node_labels.topology.k8s.aws/zone-id
|
|
- node_labels.topology.kubernetes.io/region
|
|
- node_labels.topology.kubernetes.io/zone
|
|
- node_name
|
|
- pod_image_name
|
|
- pod_name
|
|
- pod_namespace
|
|
- process_connect.destination_ip
|
|
- process_connect.destination_pod.name
|
|
- process_connect.destination_pod.namespace
|
|
- process_connect.destination_pod.pod_labels.app.kubernetes.io/component
|
|
- process_connect.destination_pod.pod_labels.app.kubernetes.io/instance
|
|
- process_connect.destination_pod.pod_labels.app.kubernetes.io/managed-by
|
|
- process_connect.destination_pod.pod_labels.app.kubernetes.io/name
|
|
- process_connect.destination_pod.pod_labels.app.kubernetes.io/part-of
|
|
- process_connect.destination_pod.pod_labels.app.kubernetes.io/version
|
|
- process_connect.destination_pod.pod_labels.eks.amazonaws.com/component
|
|
- process_connect.destination_pod.pod_labels.helm.sh/chart
|
|
- process_connect.destination_pod.pod_labels.k8s-app
|
|
- process_connect.destination_pod.pod_labels.pod-template-hash
|
|
- process_connect.destination_pod.workload
|
|
- process_connect.destination_pod.workload_kind
|
|
- process_connect.destination_port
|
|
- process_connect.parent.arguments
|
|
- process_connect.parent.auid
|
|
- process_connect.parent.binary
|
|
- process_connect.parent.cwd
|
|
- process_connect.parent.docker
|
|
- process_connect.parent.exec_id
|
|
- process_connect.parent.flags
|
|
- process_connect.parent.in_init_tree
|
|
- process_connect.parent.parent_exec_id
|
|
- process_connect.parent.pid
|
|
- process_connect.parent.pod.container.id
|
|
- process_connect.parent.pod.container.image.id
|
|
- process_connect.parent.pod.container.image.name
|
|
- process_connect.parent.pod.container.name
|
|
- process_connect.parent.pod.container.pid
|
|
- process_connect.parent.pod.container.start_time
|
|
- process_connect.parent.pod.name
|
|
- process_connect.parent.pod.namespace
|
|
- process_connect.parent.pod.pod_labels.app.kubernetes.io/instance
|
|
- process_connect.parent.pod.pod_labels.app.kubernetes.io/name
|
|
- process_connect.parent.pod.pod_labels.controller-revision-hash
|
|
- process_connect.parent.pod.pod_labels.k8s-app
|
|
- process_connect.parent.pod.pod_labels.pod-template-generation
|
|
- process_connect.parent.pod.workload
|
|
- process_connect.parent.pod.workload_kind
|
|
- process_connect.parent.start_time
|
|
- process_connect.parent.tid
|
|
- process_connect.parent.uid
|
|
- process_connect.process.arguments
|
|
- process_connect.process.auid
|
|
- process_connect.process.binary
|
|
- process_connect.process.cwd
|
|
- process_connect.process.docker
|
|
- process_connect.process.exec_id
|
|
- process_connect.process.flags
|
|
- process_connect.process.in_init_tree
|
|
- process_connect.process.parent_exec_id
|
|
- process_connect.process.pid
|
|
- process_connect.process.pod.container.id
|
|
- process_connect.process.pod.container.image.id
|
|
- process_connect.process.pod.container.image.name
|
|
- process_connect.process.pod.container.maybe_exec_probe
|
|
- process_connect.process.pod.container.name
|
|
- process_connect.process.pod.container.pid
|
|
- process_connect.process.pod.container.start_time
|
|
- process_connect.process.pod.name
|
|
- process_connect.process.pod.namespace
|
|
- process_connect.process.pod.pod_labels.app.kubernetes.io/instance
|
|
- process_connect.process.pod.pod_labels.app.kubernetes.io/name
|
|
- process_connect.process.pod.pod_labels.controller-revision-hash
|
|
- process_connect.process.pod.pod_labels.eks.amazonaws.com/component
|
|
- process_connect.process.pod.pod_labels.k8s-app
|
|
- process_connect.process.pod.pod_labels.pod-template-generation
|
|
- process_connect.process.pod.pod_labels.pod-template-hash
|
|
- process_connect.process.pod.workload
|
|
- process_connect.process.pod.workload_kind
|
|
- process_connect.process.start_time
|
|
- process_connect.process.tid
|
|
- process_connect.process.uid
|
|
- process_connect.protocol
|
|
- process_connect.sock_cookie
|
|
- process_connect.source_ip
|
|
- process_connect.source_port
|
|
- process_id
|
|
- punct
|
|
- session_id
|
|
- source
|
|
- sourcetype
|
|
- splunk_server
|
|
- splunk_server_group
|
|
- src
|
|
- src_ip
|
|
- src_port
|
|
- tag
|
|
- tag::app
|
|
- tag::eventtype
|
|
- time
|
|
- transport
|
|
- vendor_product
|
|
output_fields:
|
|
- dest_ip
|
|
- pod_name
|
|
- pod_namespace
|
|
- cluster_name
|
|
- node_name
|
|
example_log: '{"process_connect":{"process":{"exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDoxMjQ5MDAwMDAwMDoxNjQ1","pid":1645,"uid":0,"cwd":"/","binary":"/usr/bin/kubelet","arguments":"--config-dir=/etc/kubernetes/kubelet/config.json.d --kubeconfig=/var/lib/kubelet/kubeconfig --image-credential-provider-bin-dir=/etc/eks/image-credential-provider --image-credential-provider-config=/etc/eks/image-credential-provider/config.json --node-ip=192.168.89.64 --cloud-provider=external --hostname-override=ip-192-168-89-64.us-west-2.compute.internal --config=/etc/kubernetes/kubelet/config.json --node-labels=eks.amazonaws.com/sourceLaunchTemplateVersion=1,alpha.eksctl.io/cluster-name=k8s-goat-cluster,alpha.eksctl.io/nodegroup-name=ng-a99d40b1,eks.amazonaws.com/nodegroup-image=ami-0339636baccc3c183,eks.amazonaws.com/capacityType=ON_DEMAND,eks.amazonaws.com/nodegroup=ng-a99d40b1,eks.amazonaws.com/sourceLaunchTemplateId=lt-0da0169006f2a7c39","flags":"procFS auid rootcwd","start_time":"2025-09-05T19:07:18.923218536Z","auid":4294967295,"parent_exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDowOjE=","tid":1645,"in_init_tree":false},"parent":{"exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDowOjE=","pid":1,"uid":0,"cwd":"/","binary":"/usr/lib/systemd/systemd","arguments":"--switched-root --system --deserialize=32","flags":"procFS auid rootcwd","start_time":"2025-09-05T19:07:06.433217108Z","auid":4294967295,"parent_exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDoxOjA=","tid":1,"in_init_tree":false},"source_ip":"192.168.89.64","source_port":38106,"destination_ip":"192.168.88.89","destination_port":3000,"sock_cookie":"18446462614959565760","destination_pod":{"namespace":"tetragon","name":"tetragon-grafana-77b4f6f864-tjl29","pod_labels":{"app.kubernetes.io/instance":"tetragon","app.kubernetes.io/name":"grafana","app.kubernetes.io/version":"12.0.1","helm.sh/chart":"grafana-9.2.2","pod-template-hash":"77b4f6f864"},"workload":"tetragon-grafana","workload_kind":"Deployment"},"protocol":"TCP"},"node_name":"ip-192-168-89-64.us-west-2.compute.internal","time":"2025-11-04T23:32:55.401779Z","cluster_name":"k8s-goat-cluster","node_labels":{"alpha.eksctl.io/cluster-name":"k8s-goat-cluster","alpha.eksctl.io/nodegroup-name":"ng-a99d40b1","beta.kubernetes.io/arch":"arm64","beta.kubernetes.io/instance-type":"t4g.medium","beta.kubernetes.io/os":"linux","eks.amazonaws.com/capacityType":"ON_DEMAND","eks.amazonaws.com/nodegroup":"ng-a99d40b1","eks.amazonaws.com/nodegroup-image":"ami-0339636baccc3c183","eks.amazonaws.com/sourceLaunchTemplateId":"lt-0da0169006f2a7c39","eks.amazonaws.com/sourceLaunchTemplateVersion":"1","failure-domain.beta.kubernetes.io/region":"us-west-2","failure-domain.beta.kubernetes.io/zone":"us-west-2c","k8s.io/cloud-provider-aws":"16c540d8ecc5192189b6444fb194814b","kubernetes.io/arch":"arm64","kubernetes.io/hostname":"ip-192-168-89-64.us-west-2.compute.internal","kubernetes.io/os":"linux","node.kubernetes.io/instance-type":"t4g.medium","topology.k8s.aws/zone-id":"usw2-az3","topology.kubernetes.io/region":"us-west-2","topology.kubernetes.io/zone":"us-west-2c"}}'
|