Support eBPF observability / container-optimized operating systems using Sysdig Secure captures about stix-shifter

[olegzhr]

Hi,

Sysdig is based on Falco project.
If you need to see translated json Falco format to STIX-Shifter output,
you can use Alertflex connector.

please see example below:

{
"type": "bundle",
"id": "bundle--094fbe38-ab30-4e40-9416-07d5509caa93",
"spec_version": "2.0",
"objects": [
{
"type": "identity",
"id": "identity--3532c56d-ea72-48be-a2ad-1a53f4c9c6d3",
"name": "Alertflex",
"identity_class": "events"
},
{
"id": "observed-data--43bb881a-64df-4bdf-8b40-25329300e85a",
"type": "observed-data",
"created_by_ref": "identity--3532c56d-ea72-48be-a2ad-1a53f4c9c6d3",
"created": "2021-07-29T21:24:34.011Z",
"modified": "2021-07-29T21:24:34.011Z",
"objects": {
"0": {
"type": "ipv4-addr",
"value": "0.0.0.0"
},
"1": {
"type": "network-traffic",
"src_ref": "0",
"dst_port": 0,
"protocols": [
"ip"
],
"src_port": 0,
"dst_ref": "4"
},
"2": {
"type": "process",
"name": "altprobe"
},
"3": {
"type": "file",
"name": "/etc/altprobe/filters.json"
},
"4": {
"type": "ipv4-addr",
"value": "0.0.0.0"
},
"5": {
"type": "user-account",
"user_id": "root"
}
},
"x_org_alertflex": {
"severity": 2,
"agent": "collr02",
"description": "00:16:25.340210122: Error File below /etc opened for writing (user=root command=altprobe start parent=altprobe pcmdline=altprobe start file=/etc/altprobe/filters.json program=altprobe gparent= ggparent= gggparent= container_id=host image=)",
"source": "Falco",
"type": "HOST",
"node": "node01",
"event": "Write below etc",
"category": "falco, filesystem, mitre_TA0003",
"info": "indef"
},
"first_observed": "2021-07-29T21:16:25.000Z",
"last_observed": "2021-07-29T21:16:25.000Z",
"number_observed": 1
}
]
}

[JasonKeirstead]

This is a very interesting proposal.

[marcredhat]

Thanks @JasonKeirstead
Please see a short video at http://bit.ly/threatmanage

[mdazam1942]

@marcredhat do you have any proposed implementation?