Kubernetes StormCenter: Find runtime threats -- store only the evidence

This deploys an open-source SOC for k8s, so that you can visualize ongoing attacks, post-exploitation, save the evidence to a clickhouse database.

It employs adaptive exporting and real-time statistical correlation that remains on the node. This means:

• your data never has to leave your datacenter
• you can tune how much evidence you want to save
• what you consider evidence

We expressely thank the upstream maintainers of our main components: KubeScape and Pixie

If you like it -> consider leaving a star ⭐

Why its cool, cause it has adaptive features that allow filtering out the noise:

Components:

• pixie: for the 24 hr history of all interesting protocols
  This allows the reconstruction of the attack paths and the construction of evidence that either corroborates that an attack occured or tells you where an attack failed (e.g the initial breach and pivot might have happened but they failed at the exfiltration)

• pixie cloud: for visualizing the data across all live clusters as well as the forensic database

• kubescape: for a coarse filtering at any given point in time
  This allows anchoring known malicious signals to kick off the investigation -> you must use a high-contrast bill of behavior (sbob) to ensure your false negatives are low and you know your blindspots.

• clickhouse: for saving the data out of band from your cluster Sharded by node

• vector: for moving data from A to B (might be replaced by a dedicated protocol later)

Backlog

We are looking at a first release end of this summer, so that you can try it out in a compact all on one k3s playground

THIS IS CURRENTLY NOT PRODUCTION READY and NOT STABLE, there is no governance or openssf scorecard, yet... its coming...

Note

This repo contains the deployment artefacts for a sovereign SOC stack -- all development currently is on the individual repos (see the pixie/fork and the node-agent/fork and bob). The old code has been moved into the deprecated folder.

Install

Prereqs: a k8s cluster with Pixie deployed using the pem-direct configuration.

skaffold run -m soc-stack

kubectl -n pl set image ds/adaptive-export \
  adaptive-export=ghcr.io/k8sstormcenter/vizier-adaptive_export_image:0.14.19-aeprod47
kubectl -n pl set env ds/adaptive-export \
  INSTALL_PRESET_SCRIPTS=true \
  CLICKHOUSE_USER=ingest_writer CLICKHOUSE_PASSWORD=changeme-ingest \
  CLICKHOUSE_HOST=clickhouse-forensic-soc-db.clickhouse.svc.cluster.local \
  CLICKHOUSE_PORT=9000 CLICKHOUSE_DATABASE=forensic_db

Run the e2e test (redis)

Deploys the vulnerable Redis + its SBOB (user-defined ContainerProfile), fires the post-compromise stage-2 attacks, and exports.

./run-redis-e2e.sh            # deploy redis -> bind SBOB -> attack-suite -> assert detections

Evidence in ClickHouse

Kubescape fires the alert; the Adaptive Export writes the correlated Pixie evidence to forensic_db.

dc_snoop              redis-server  redis  R proc/self/stat   +  sh bash getent whoami cat  (attack exec)
dns_events            {"queries":[{"name":"xmr.pool.minergate.com","type":"A"}]}   (also evil.attacker.example.com)
conn_stats            redis  127.0.0.1  proto:7  sent:19628 recv:39256
redis_events          redis  EVAL  io.popen("getent hosts xmr.pool.minergate.com")   (CVE-2022-0543 Lua sandbox escape -> OS cmd)
stack_trace           redis  __open;[k] entry_SYSCALL_64_after_hwframe  count:1
adaptive_attribution  redis/sh  R0002  n_anomalies:1846