soc

KO | EN

gitlite — search

#javascript #python #hacktoberfest #ai #llm #machine-learning #linux #docker #awesome #cli #vue #awesome-list #security #openai

(★ 55)

Sovereign kubernetes security operations center. Real-time false positives tuning

soc Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Kubernetes StormCenter: Find runtime threats -- store only the evidence

This deploys an open-source SOC for `k8s`, so that you can visualize ongoing attacks, post-exploitation, save the evidence to a clickhouse database.

It employs adaptive exporting and real-time statistical correlation that remains on the node. 
This means:  
- your data never has to leave your datacenter
- you can tune how much evidence you want to save
- what you consider evidence

We expressely thank the upstream maintainers of our main components: KubeScape and Pixie

If you like it -> consider leaving a star ⭐

Why its cool, cause it has adaptive features that allow filtering out the noise:
<img width="1445" height="747" alt="PixieDXAttackGraph" src="https://github.com/user-attachments/assets/d50a5e7c-662b-4881-b384-c72de8ea5e96" />
<img width="1454" height="920" alt="PixieDXAttackGraphNoise" src="https://github.com/user-attachments/assets/2bfb2506-31d1-43e2-b2a8-27ca3800f12c" />

## Components:
- pixie: for the 24 hr history of all interesting protocols  
This allows the reconstruction of the attack paths and the construction of evidence that either corroborates that an attack occured or tells you where an attack failed (e.g the initial breach and pivot might have happened but they failed at the exfiltration)

- pixie cloud: for visualizing the data across all live clusters as well as the forensic database

- kubescape: for a coarse filtering at any given point in time  
This allows anchoring known malicious signals to kick off the investigation
-> you must use a high-contrast [bill of behavior](https://billofbehavior.com) (sbob) to ensure your false negatives are low and you know your blindspots.

- clickhouse: for saving the data out of band from your cluster
Sharded by node

- vector: for moving data from A to B  (might be replaced by a dedicated protocol later)

## Backlog

We are looking at a first release end of this summer, so that you can try it out in a compact `all on one k3s` playground

THIS IS CURRENTLY NOT PRODUCTION READY and NOT STABLE, there is no governance or openssf scorecard, yet... its coming...

> [!NOTE]
> This repo contains the deployment artefacts for a sovereign SOC stack -- all development currently is on the individual repos (see the pixie/fork and the node-agent/fork and bob). The old code has been moved into the `deprecated` folder.
>

## Install

Prereqs: a `k8s` cluster  with **Pixie** deployed using the `pem-direct` configuration.

```bash
skaffold run -m soc-stack

kubectl -n pl set image ds/adaptive-export \
  adaptive-export=ghcr.io/k8sstormcenter/vizier-adaptive_export_image:0.14.19-aeprod47
kubectl -n pl set env ds/adaptive-export \
  INSTALL_PRESET_SCRIPTS=true \
  CLICKHOUSE_USER=ingest_writer CLICKHOUSE_PASSWORD=changeme-ingest \
  CLICKHOUSE_HOST=clickhouse-forensic-soc-db.clickhouse.svc.cluster.local \
  CLICKHOUSE_PORT=9000 CLICKHOUSE_DATABASE=forensic_db
```

## Run the e2e test (redis)

Deploys the vulnerable Redis + its SBOB (user-defined ContainerProfile), fires the
post-compromise stage-2 attacks, and exports.

```bash
./run-redis-e2e.sh            # deploy redis -> bind SBOB -> attack-suite -> assert detections
```

## Evidence in ClickHouse

Kubescape fires the alert; the Adaptive Export writes the correlated Pixie
evidence to `forensic_db`.

```
dc_snoop              redis-server  redis  R proc/self/stat   +  sh bash getent whoami cat  (attack exec)
dns_events            {"queries":[{"name":"xmr.pool.minergate.com","type":"A"}]}   (also evil.attacker.example.com)
conn_stats            redis  127.0.0.1  proto:7  sent:19628 recv:39256
redis_events          redis  EVAL  io.popen("getent hosts xmr.pool.minergate.com")   (CVE-2022-0543 Lua sandbox escape -> OS cmd)
stack_trace           redis  __open;[k] entry_SYSCALL_64_after_hwframe  count:1
adaptive_attribution  redis/sh  R0002  n_anomalies:1846
```

soc

soc Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

soc

soc Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README