Defender syslog event types

Container runtime audit

  Jul 30 22:41:25 user-root Twistlock-Defender[13460]:
    time="2019-07-30T22:41:25.448709847Z"
    type="container_runtime_audit"
    container_id="73c2e8267f9b80ea152403c36c377476d24e43e211bb098300a317b3d1c472e4"
    container_name="/dreamy_rosalind" image_id="sha256:94e814e2efa8845d95b2112d54497fbad173e45121ce9255b93401392f538499"
    image_name="ubuntu:18.04"
    effect="alert"
    msg="High rate of reg file access events, reporting aggregation started;
    last event: /usr/lib/apt/methods/gpgv wrote a suspicious file to /tmp/apt.conf.2ZH7tP.
    Command: /usr/lib/apt/methods/gpgv"
    log_type="filesystem"
    custom_labels="io.kubernetes.pod.namespace:default"
    account_id="prisma-cloud-compute"
    cluster="cluster1"

Host runtime audit

  Jul 30 22:47:12 user-root Twistlock-Defender[13460]:
    time="2019-07-30T22:47:12.325487039Z"
    type="host_runtime_audit"
    service_name="ssh"
    effect="alert"
    msg="Outbound connection by /usr/lib/apt/methods/http to an unexpected port: 80 IP: 91.189.91.26. Low severity audit, event is automatically added to the runtime model"
    log_type="network"
    account_id="prisma-cloud-compute"
    cluster="cluster1"

Access audit

[Bruce] [started container X] in the [DEV environment] (allowed).
[Bruce] [stopped container Y] in the [PROD environment] (denied).

Bruce, a developer, issues a command, docker -H.
Defender checks the command against the policies defined in the Console. If the command is allowed, Defender forwards it to the Docker daemon for execution. If the command is denied, the user is notified.
An event is recorded in syslog.

type=access_audit
user=[String] Identity of the person who ran the command
action=[String] Docker command requested - API invoked
action_type=[String] Action type
allow=[Boolean] true/false - Action was allowed or not.
rule=[String] Rule matched

  Jul 30 23:02:23 user-root Twistlock-Defender[13460]:
    time="2019-07-30T23:02:23.179494498Z"
    type="access_audit"
    user="user"
    action="docker_ping"
    action_type="docker"
    allow="true"
    rule="Default - allow all"

App firewall audit (WAAS)

container_id=[String]
Container id in which the event triggered
container_name=[String]
Container name on which the action was performed
image_name=[String]
Image name on which the action was performed
custom_labels=[String]
User-defined Alert Labels (
Mange > Alerts > Alert Labels
)
cluster=[String]
Cluster name in which the event triggered

hostname=[String]
host in which the event triggered
cluster=[String]
Cluster name in which the event triggered

app_id=[String]
app_id in which the event triggered

time=[String]
request timestamp
type=[String]
type of app_firewall_audit
effect=[String]
"alert", "prevent", "ban"
msg=[String]
Audit message detailing the event
log_type=[String]
Attack Type
source_ip=[String]
source IP address from the request originated
source_country=[String]
country associated with source IP address
connecting_ips=[CSV]
list of IPs included in the X-Forwarded-For header
request_method=[String]
HTTP Request Method
request_user_agents=[String]
user-agent string parsed from the User-Agent header
request_host=[String]
HTTP hostname in the request
request_url=[String]
request url
request_path=[String]
request path
request_query=[String]
request query string
request_header_names=[String]
ordered list of HTTP request headers
response_header_names=[String]
ordered list of HTTP response headers
status_code=[String]
HTTP response status code in the server response

Fields containing empty values are omitted from the message i.e. if a HTTP message does not contain a query field the request_query field will not be present in the message.
connecting_ips
- present only if X-Forwarded-For Header is present in the request.
status_code
- present only for audits created for the "Track Server Error Response Codes" and "Detect Information Leakage" protections
response_header_names
- present only for audits created for the "Track Server Error Response Codes" and "Detect Information Leakage" protections.
source_country
- present only if resolution was successful.
container_name
- will be replaced by
host_id
or
function_id

  Jul 16 20:10:16 cnaf-nightly-build Twistlock-Defender[1947]:
    time="2020-07-16T20:10:16.706085135Z"
    type="container_app_firewall_audit"
    container_id="0a16b4e4dbefc6ef8cc6a08d038e775a8523ad053416730f01eafbf2dee2e693"
    container_name="/nginx"
    image_name="nginx:latest"
    effect="prevent"
    msg="Client exceeded violations within 1m. Banning client for 5m"
    log_type="violations exceeded"
    source_ip="12.34.56.78"
    source_country="IL"
    connecting_ips="11.22.33.44"
    request_method="HEAD"
    request_user_agents="curl/7.54.0"
    request_host="www.example.com"
    request_url="www.example.com/?id=../etc/passwd"
    request_path="/"
    request_query="id=../etc/passwd"
    request_header_names="X-Forwarded-For,User-Agent,Accept"
    response_header_names="Set-Cookie,Date,Content-Type,Content-Length X-Frame-Options"
    status_code="404"

Process activity audit

type=process
pid=Process ID
path=Path to the executable in the container file system
interactive=Whether the process was spawned from a shell session: true or false
container-id=Container ID

  Jul 30 22:06:03 user-root Twistlock-Defender[13460]:
    time="2019-07-30T22:06:03.515319204Z"
    type="process"
    pid="20859"
    path="/bin/df"
    interactive="false"
    container_id="3491b03544a51c60e176e54a5077161f14dbc850bf069cf7a096db028e9981de"

Incidents

  Jul 30 22:41:24 user-root Twistlock-Defender[13460]:
    time="2019-07-30T22:41:24.987209676Z"
    type="incident"
    container_id="73c2e8267f9b80ea152403c36c377476d24e43e211bb098300a317b3d1c472e4"
    image_name="ubuntu:18.04"
    host="user-root.c.cto-sandbox.internal"
    incident_category="hijackedProcess"
    custom_labels="io.kubernetes.pod.namespace:default"
    account_id="prisma-cloud-compute"
    cluster="cluster1"

  Mar  5 00:26:42 user-root Twistlock-Defender[22797]:
    time="2018-03-05T00:26:42.894707831+02:00"
    type="incident"
    service_name="http-service"
    host="user-root"
    incident_category="serviceViolation"
    audit_ids="5a9c72a223d020590de74db5"
    account_id="prisma-cloud-compute"
    cluster="cluster1"