mirror of
https://github.com/nold360/hive-apps
synced 2024-11-16 02:29:34 +00:00
Delete: Falco
This commit is contained in:
parent
bcf7b46d1c
commit
e25826794e
2 changed files with 0 additions and 227 deletions
|
|
@ -1,8 +0,0 @@
|
|||
config:
|
||||
description: Falco Security
|
||||
apps:
|
||||
- name: falco
|
||||
disabled: true
|
||||
repoURL: https://falcosecurity.github.io/charts
|
||||
chart: falco
|
||||
targetRevision: 1.16.0
|
||||
|
|
@ -1,219 +0,0 @@
|
|||
docker:
|
||||
enabled: false
|
||||
|
||||
podSecurityPolicy:
|
||||
create: false
|
||||
|
||||
containerd:
|
||||
enabled: true
|
||||
|
||||
#extraArgs:
|
||||
# - --disable-cri-async
|
||||
|
||||
falco:
|
||||
timeFormatISO8601: true
|
||||
grpc:
|
||||
enabled: true
|
||||
grpcOutput:
|
||||
enabled: false
|
||||
|
||||
falcosidekick:
|
||||
enabled: true
|
||||
replicaCount: 1
|
||||
podSecurityPolicy:
|
||||
create: true
|
||||
|
||||
webui:
|
||||
enabled: true
|
||||
retention: 200
|
||||
darkmode: true
|
||||
podSecurityPolicy:
|
||||
create: true
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
hosts:
|
||||
- host: falco.dc
|
||||
paths: ["/ui", "/events", "/healthz", "/ws"]
|
||||
tls:
|
||||
- secretName: falcosidekick-tls
|
||||
hosts:
|
||||
- falco.dc
|
||||
|
||||
customRules:
|
||||
rule_exceptions.yaml: |-
|
||||
- rule: Contact K8S API Server From Container
|
||||
exceptions:
|
||||
- name: proc_filenames
|
||||
value:
|
||||
- argocd-applicat
|
||||
append: true
|
||||
- rule: Write below root
|
||||
exceptions:
|
||||
- name: container
|
||||
value: [ host ]
|
||||
append: true
|
||||
- rule: Read sensitive file untrusted
|
||||
exceptions:
|
||||
- name: container
|
||||
value: [ host ]
|
||||
append: true
|
||||
- rule: Non sudo setuid
|
||||
exceptions:
|
||||
- name: container
|
||||
value: [ host ]
|
||||
append: true
|
||||
nginx_rules.yaml: |-
|
||||
- macro: nginx_consider_syscalls
|
||||
condition: (evt.num < 0)
|
||||
- macro: app_nginx
|
||||
condition: container and container.image contains "nginx"
|
||||
# Any outbound traffic raises a WARNING
|
||||
- rule: Unauthorized process opened an outbound connection (nginx)
|
||||
desc: A nginx process tried to open an outbound connection and is not whitelisted
|
||||
condition: outbound and evt.rawres >= 0 and app_nginx
|
||||
output: Non-whitelisted process opened an outbound connection (command=%proc.cmdline connection=%fd.name)
|
||||
priority: WARNING
|
||||
# Restricting listening ports to selected set
|
||||
- list: nginx_allowed_inbound_ports_tcp
|
||||
items: [80, 443, 8080, 8443]
|
||||
- rule: Unexpected inbound tcp connection nginx
|
||||
desc: Detect inbound traffic to nginx using tcp on a port outside of expected set
|
||||
condition: inbound and evt.rawres >= 0 and not fd.sport in (nginx_allowed_inbound_ports_tcp) and app_nginx
|
||||
output: Inbound network connection to nginx on unexpected port (command=%proc.cmdline pid=%proc.pid connection=%fd.name sport=%fd.sport user=%user.name %container.info image=%container.image)
|
||||
priority: NOTICE
|
||||
# Restricting spawned processes to selected set
|
||||
- list: nginx_allowed_processes
|
||||
items: ["nginx", "app-entrypoint.", "basename", "dirname", "grep", "nami", "node", "tini"]
|
||||
- rule: Unexpected spawned process nginx
|
||||
desc: Detect a process started in a nginx container outside of an expected set
|
||||
condition: spawned_process and not proc.name in (nginx_allowed_processes) and app_nginx
|
||||
output: Unexpected process spawned in nginx container (command=%proc.cmdline pid=%proc.pid user=%user.name %container.info image=%container.image)
|
||||
priority: NOTICE
|
||||
# Restricting files read or written to specific set
|
||||
- list: nginx_allowed_file_prefixes_readwrite
|
||||
items: ["/var/log/nginx", "/var/run"]
|
||||
# Remember to add your nginx cache path
|
||||
|
||||
- rule: Unexpected file access readwrite for nginx
|
||||
desc: Detect an attempt to access a file readwrite other than below an expected list of directories
|
||||
condition: (open_write) and not fd.name pmatch (nginx_allowed_file_prefixes_readwrite) and app_nginx
|
||||
output: Unexpected file accessed readwrite for nginx (command=%proc.cmdline pid=%proc.pid file=%fd.name %container.info image=%container.image)
|
||||
priority: NOTICE
|
||||
# Restricting syscalls to selected set
|
||||
- list: nginx_allowed_syscalls
|
||||
items: [accept, bind, clone, connect, dup, listen, mkdir, open, recvfrom, recvmsg, sendto, setgid, setuid, socket, socketpair]
|
||||
- rule: Unexpected syscall nginx
|
||||
desc: Detect a syscall in a nginx container outside of an expected set
|
||||
condition: nginx_consider_syscalls and not evt.type in ("<unknown>", nginx_allowed_syscalls) and app_nginx
|
||||
output: Unexpected syscall in nginx container (command=%proc.cmdline pid=%proc.pid user=%user.name syscall=%evt.type args=%evt.args %container.info image=%container.image)
|
||||
priority: NOTICE
|
||||
warn_evttypes: False
|
||||
|
||||
php_fpm.yaml: |-
|
||||
- macro: php_fpm_consider_syscalls
|
||||
condition: (evt.num < 0)
|
||||
|
||||
- macro: app_php_fpm
|
||||
condition: container and container.image contains "fpm"
|
||||
|
||||
# Considering any inbound network connection suspect
|
||||
- rule: Unexpected inbound connection php_fpm
|
||||
desc: Detect any inbound connection arriving at php_fpm
|
||||
condition: inbound and evt.rawres >= 0 and app_php_fpm
|
||||
output: Unexpected inbound connection arriving at php_fpm (command=%proc.cmdline pid=%proc.pid connection=%fd.name user=%user.name %container.info image=%container.image)
|
||||
priority: NOTICE
|
||||
|
||||
# Restricting listening ports to selected set
|
||||
|
||||
- list: php_fpm_allowed_inbound_ports_tcp
|
||||
items: [80, 443]
|
||||
|
||||
- rule: Unexpected inbound tcp connection php_fpm
|
||||
desc: Detect inbound traffic to php_fpm using tcp on a port outside of expected set
|
||||
condition: inbound and evt.rawres >= 0 and not fd.sport in (php_fpm_allowed_inbound_ports_tcp) and app_php_fpm
|
||||
output: Inbound network connection to php_fpm on unexpected port (command=%proc.cmdline pid=%proc.pid connection=%fd.name sport=%fd.sport user=%user.name %container.info image=%container.image)
|
||||
priority: NOTICE
|
||||
|
||||
# Restricting spawned processes to selected set
|
||||
|
||||
- list: php_fpm_allowed_processes
|
||||
items: ["/usr/bin/python2", "nginx", "nginx: master process /usr/sbin/nginx -g daemon off; error_log /dev/stderr info;", "nginx: worker process", "php-fpm", "php-fpm: pool www"]
|
||||
|
||||
- rule: Unexpected spawned process php_fpm
|
||||
desc: Detect a process started in a php_fpm container outside of an expected set
|
||||
condition: spawned_process and not proc.name in (php_fpm_allowed_processes) and app_php_fpm
|
||||
output: Unexpected process spawned in php_fpm container (command=%proc.cmdline pid=%proc.pid user=%user.name %container.info image=%container.image)
|
||||
priority: NOTICE
|
||||
|
||||
# Restricting files read or written to specific set
|
||||
|
||||
- list: php_fpm_allowed_file_prefixes_readonly
|
||||
items: ["/dev", "/var/www/errors"]
|
||||
|
||||
- rule: Unexpected file access readonly for php_fpm
|
||||
desc: Detect an attempt to access a file readonly other than below an expected list of directories
|
||||
condition: (open_read and evt.is_open_write=false) and not fd.name pmatch (php_fpm_allowed_file_prefixes_readonly) and app_php_fpm
|
||||
output: Unexpected file accessed readonly for php_fpm (command=%proc.cmdline pid=%proc.pid file=%fd.name %container.info image=%container.image)
|
||||
priority: NOTICE
|
||||
|
||||
- list: php_fpm_allowed_file_prefixes_readwrite
|
||||
items: ["/dev", "/tmp", "/usr/local/var/log"]
|
||||
|
||||
- rule: Unexpected file access readwrite for php_fpm
|
||||
desc: Detect an attempt to access a file readwrite other than below an expected list of directories
|
||||
condition: (open_write) and not fd.name pmatch (php_fpm_allowed_file_prefixes_readwrite) and app_php_fpm
|
||||
output: Unexpected file accessed readwrite for php_fpm (command=%proc.cmdline pid=%proc.pid file=%fd.name %container.info image=%container.image)
|
||||
priority: NOTICE
|
||||
|
||||
postgres.yaml: |-
|
||||
- macro: postgres_consider_syscalls
|
||||
condition: (evt.num < 0)
|
||||
|
||||
- macro: app_postgres
|
||||
condition: container and container.image contains "postgres"
|
||||
|
||||
- list: postgres_allowed_inbound_ports_tcp
|
||||
items: [5432]
|
||||
|
||||
- rule: Unexpected inbound tcp connection postgres
|
||||
desc: Detect inbound traffic to postgres using tcp on a port outside of expected set
|
||||
condition: inbound and evt.rawres >= 0 and not fd.sport in (postgres_allowed_inbound_ports_tcp) and app_postgres
|
||||
output: Inbound network connection to postgres on unexpected port (command=%proc.cmdline pid=%proc.pid connection=%fd.name sport=%fd.sport user=%user.name %container.info image=%container.image)
|
||||
priority: NOTICE
|
||||
|
||||
# Restricting spawned processes to selected set
|
||||
|
||||
- list: postgres_allowed_processes
|
||||
items: ["/proc/self/exe", "pg_isready", "postgres", "psql", "postgres: autovacuum launcher process", "pg_ctl" , "postgres: checkpointer process ", "postgres: stats collector process ", "postgres: wal writer process ", "postgres: writer process ", "sh"]
|
||||
|
||||
- rule: Unexpected spawned process postgres
|
||||
desc: Detect a process started in a postgres container outside of an expected set
|
||||
condition: spawned_process and not proc.name in (postgres_allowed_processes) and app_postgres
|
||||
output: Unexpected process spawned in postgres container (command=%proc.cmdline pid=%proc.pid user=%user.name %container.info image=%container.image)
|
||||
priority: NOTICE
|
||||
|
||||
# Restricting files read or written to specific set
|
||||
|
||||
- list: postgres_allowed_file_prefixes_readonly
|
||||
items: ["/dev", "/etc", "/lib/x86_64-linux-gnu", "/usr/lib/locale", "/usr/lib/x86_64-linux-gnu", "/usr/share/locale", "/var/lib/postgresql/data", "/usr/share/zoneinfo", "/var/lib/postgresql", "/usr/lib/postgresql", "/usr/share/postgresql", "/var/run/postgresql"]
|
||||
|
||||
- rule: Unexpected file access readonly for postgres
|
||||
desc: Detect an attempt to access a file readonly other than below an expected list of directories
|
||||
condition: (open_read and evt.is_open_write=false) and not fd.name pmatch (postgres_allowed_file_prefixes_readonly) and app_postgres
|
||||
output: Unexpected file accessed readonly for postgres (command=%proc.cmdline pid=%proc.pid file=%fd.name %container.info image=%container.image)
|
||||
priority: NOTICE
|
||||
|
||||
- list: postgres_allowed_file_prefixes_readwrite
|
||||
items: ["/var/lib/postgresql/data", "/var/run/postgresql"]
|
||||
|
||||
- rule: Unexpected file access readwrite for postgres
|
||||
desc: Detect an attempt to access a file readwrite other than below an expected list of directories
|
||||
condition: (open_write) and not fd.name pmatch (postgres_allowed_file_prefixes_readwrite) and app_postgres
|
||||
output: Unexpected file accessed readwrite for postgres (command=%proc.cmdline pid=%proc.pid file=%fd.name %container.info image=%container.image)
|
||||
priority: NOTICE
|
||||
|
||||
# For OpenShit
|
||||
scc:
|
||||
create: false
|
||||
Loading…
Reference in a new issue