Kaspersky Container Security
- Kaspersky Container Security 2.0 Help
- About the Kaspersky Container Security platform
- Solution architecture
- Standard deployment schemes
- Preparing to install the solution
- Solution installation
- Installing the basic business logic module and scanner
- First launch of the Management Console
- Viewing and accepting the End User License Agreement
- Checking solution functionality
- Agent deployment
- Viewing and editing agent groups
- Configuring a proxy server
- Connecting to external data storage resources
- Installing private fixes
- Removing the solution
- Updating the solution
- Solution interface
- Licensing the solution
- Data provisioning
- Working with clusters
- View the list of clusters
- Namespaces in the cluster
- Pods in the cluster
- Visualization of cluster resources
- Working with images from registers
- Investigating security events
- Analyzing container forensics
- Searching container forensics
- Detailed information about a running process
- Detailed information about file operations
- Details information about network traffic
- Detailed information about detected malicious objects
- Restrictions on runtime policies
- Investigating container forensics while accounting for adjacent events
- Analyzing detected vulnerabilities
- Analyzing container forensics
- Integration with third-party resources
- Setting up integration with external image registries
- Minimum sufficient rights for integration with registries
- Working with public registries without authorization
- Adding integrations with external image registries
- Viewing information about integrations with registries
- Deleting integration with external registry
- Harbor integration
- Creating an integration upon Harbor request
- Viewing and editing the Harbor External Integration settings
- Rescanning
- Integration with CI/CD
- Artifact scanning in CI/CD processes
- Configuring integration with GitLab CI/CD
- Configuring integration with Jenkins CI/CD
- Configuring integration with TeamCity CI/CD
- Defining the path to container images
- Monitoring the integrity and origin of images
- Running the scanner in SBOM mode
- Running the scanner in lite SBOM mode
- Getting scan results in JSON or HTML format
- Specifying secrets when starting a scan
- Configuring integration with image signature validators
- Setting up integration with notification outputs
- Configuring LDAP server integration
- Configuring integration with SIEM systems
- Integrating with HashiCorp Vault
- Setting up integration with external image registries
- Security policies configuration
- Scanner policies
- Assurance policies
- Response policies
- Runtime policies
- Creating a runtime policy
- Editing runtime policy settings
- Managing container runtime profiles
- Managing runtime autoprofiles
- Deleting policies
- Compliance check
- Configuring and generating reports
- File Threat Protection
- Users, roles, and scopes
- Managing users
- About user roles
- Working with system roles
- Displaying list of roles
- About scopes
- Scopes and enforcement of security policies
- Switching between scopes
- Adding users, roles, and scopes
- Resetting password for user accounts
- Changing settings for users, roles, and scopes
- Removing users, roles, and scopes
- Using Kaspersky Container Security OpenAPI
- Security event log
- Information about the status of solution components
- Ensuring safety and reliability of components
- Managing the dynamics of data accumulation
- Backing up and restoring data
- Contacting Technical Support
- Sources of information about the application
- Limitations and warnings
- Vulnerabilities in third-party services
- Glossary
- Third party code information
- Trademark notices
- ATT&CK MITRE Terms of Use
Configuring integration with SIEM systems
Kaspersky Container Security allows connecting to
Security information and event management (SIEM) is a class of software solutions that obtain and analyze data about security events.
Messages are sent to a SIEM system in the
The Common Event Format is a standardized structured data format for logging events in the security event log. CEF is based on the Syslog format, which is a message logging standard supported by most network devices and operating systems.
CEF:0|Kaspersky|Kaspersky Container Security|2.0|PM-002|Process management|7|dpid=1846367 spid=1845879 flexString2=0ce05246346b6687cb754cf716c57f20f226e159397e8e5985e55b448cb92e3f flexString2Label=Container ID cs6=alpine cs6Label=Container name outcome=Success
The transmitted message consists of the following components:
- The Syslogheader, which specifies the date, time, and host name.
A standard for sending and logging system event messages used for the UNIX and GNU/Linux platforms.
- Prefix and CEF version number.
- Device vendor.
- Solution name.
- Solution version.
- Solution-generated unique event type code.
- Event description.
- Event severity assessment.
- Additional information, such as device IP address, event reason, event result, and event status.
For detailed information about the components, refer to the CEF message value matching table.
|
In this Help section Matching of CEF message fields Creating an integration with a SIEM system Linking agent groups with a SIEM system |