Configuring integration with SIEM systems

Kaspersky Container Security allows connecting to

Messages are sent to a SIEM system in the

CEF:0|Kaspersky|Kaspersky Container Security|2.0|PM-002|Process management|7|dpid=1846367 spid=1845879 flexString2=0ce05246346b6687cb754cf716c57f20f226e159397e8e5985e55b448cb92e3f flexString2Label=Container ID cs6=alpine cs6Label=Container name outcome=Success

The transmitted message consists of the following components:

• The
  Syslog

  A standard for sending and logging system event messages used for the UNIX and GNU/Linux platforms.

  header, which specifies the date, time, and host name.
• Prefix and CEF version number.
• Device vendor.
• Solution name.
• Solution version.
• Solution-generated unique event type code.
• Event description.
• Event severity assessment.
• Additional information, such as device IP address, event reason, event result, and event status.

For detailed information about the components, refer to the CEF message value matching table.

Matching of CEF message fields

CEF messages are sent in the English language.

The table below lists the man components of the header and body of CEF messages sent by Kaspersky Container Security.

Components and values of CEF message components

Additional information about an event which is transferred by Kaspersky Container Security

Page top

Creating an integration with a SIEM system

To add a SIEM integration:

1. In the Administration → Integrations → SIEM section, click Add SIEM.

   A sidebar is displayed, in which you can enter the parameters of SIEM system.

2. On the General tab, specify the following required parameters:
   • Name of the SIEM system.
   • Protocol for connecting to the SIEM system. TCP is selected by default.
   • Address of the SIEM system server in one of the following formats:
     • IPv4
     • IPv6
     • FQDN
   • Port for connecting to the SIEM system. You can specify ports 1 through 65535. The default setting is 514.
   • Event categories for which you want messages to be exported to the SIEM system. To configure this, select the check boxes next to one or more event categories from the following list:
     • Administration.
     • Alert.
     • CI/CD.
     • Policies.
     • Resources.
     • Scanners.
     • Admission controller.
     • Forensic data.
     • API.

       An advanced license is required to view events in the Resources, Scanners, Admission controller, and Forensic data categories.

     By default, all statuses are selected.

     Messages about selected event categories are sent to the specified SIEM system, regardless of whether it is linked to agent groups.

3. On the Agent group logs tab, select the check boxes next to one or more event types as part of node monitoring in the runtime.

   The log of event messages sent to the runtime environment can be very large, which can impact available disk space and network load.

4. If you want to verify the correctness of the specified SIEM integration parameters, click Test connection.

   The solution tests the connection to the SIEM system if the TCP connection protocol is selected. If the UDP connection protocol is selected, the Test connection button is disabled.

5. Click Save.

Page top

Linking agent groups with a SIEM system

You can link agent groups to SIEM systems while creating agent groups or editing their parameters in the Components → Agents section.

To link an agent group in Kaspersky Container Security, you must have sufficient rights to manage agent groups; you must also create and configure at least one SIEM integration.

Page top

Viewing and editing SIEM integration settings

To view a SIEM integration:

1. Open the list of SIEM integrations in the Administration → Integrations → SIEM section.
2. Click the integration name in the list of integrations.

To edit SIEM integration settings:

1. In the Administration → Integrations → SIEM section, click the integration name in the list of integrations.
2. If necessary, in the displayed sidebar, edit the integration parameters as follows:
   1. On the General tab, edit the following required parameters:
      • Name of the SIEM system
      • Protocol for connecting to the SIEM system
      • SIEM system server address
      • SIEM system connection port
      • Categories of events to be exported
   2. If necessary, on the Agent group logs tab, you can edit the list of network node monitoring event types selected for the runtime.
3. If TCP is used for the connection, click Test connection to see if the connection to the SIEM system is can be established.
4. Click Save.

Deleting an integration with a SIEM system

To delete a SIEM integration:

1. Open the list of configured SIEM integrations in the Administration → Integrations → SIEM section.
2. Select the integration that you want to delete by selecting the check box in the row with the integration name.
3. Click Delete above the table.

   The Delete button becomes enabled after you select one or more integrations.

4. In the window that opens, confirm the deletion.

Page top