leonidas/sigma-pipeline-kubernetes-to-elk.yml at master · ReversecLabs/leonidas · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
name: Mapping of Kubernetes test cases for ELK's default Kubernetes integration
priority: 30
transformations:

# Step 1 - checks for performance

- id: index_condition
  type: add_condition
  # only search upon Kubernetes audit logs
  conditions:
    kubernetes.audit.kind: Event
  # only transform fields if this is a Kubernetes rule
  rule_conditions:
  - type: logsource
    product: kubernetes

# Step 2 - the transformations


# Map simplified Sigma fields to the names ELK assigns them
- id: field_mapping
  type: field_name_mapping
  mapping:
    verb:
    - kubernetes.audit.verb
    apiGroup:
    - kubernetes.audit.objectRef.apiGroup
    resource:
    - kubernetes.audit.objectRef.resource
    subresource:
    - kubernetes.audit.objectRef.subresource
    namespace:
    - kubernetes.audit.objectRef.namespace
    capabilities:
    - kubernetes.audit.requestObject.spec.containers.securityContext.capabilities.add
    hostPath:
    - kubernetes.audit.requestObject.spec.volumes.hostPath

# If apiGroup is "" OR omitted, then drop from query, as the ELK Kubernetes integration doesn't set this event field when apiGroup is the default
- id: drop_default_apigroup
  type: drop_detection_item
  field_name_conditions:
  - type: include_fields
    fields:
    - apiGroup
    - kubernetes.audit.objectRef.apiGroup
  detection_item_conditions:
  - type: match_string
    cond: any
    pattern: "^$"

# If subresource is "" OR omitted, then drop from query, as the ELK Kubernetes integration doesn't set this event field for resource-only endpoints
- id: drop_empty_subresource
  type: drop_detection_item
  field_name_conditions:
  - type: include_fields
    fields:
    - subresource
    - kubernetes.audit.objectRef.subresource
  detection_item_conditions:
  - type: match_string
    cond: any
    pattern: "^$"