|
| 1 | +--- |
| 2 | +id: sysdig-secure |
| 3 | +title: Sysdig Secure |
| 4 | +sidebar_label: Sysdig Secure |
| 5 | +description: The Sysdig Secure app for Sumo Logic provides insights into container security and and manage runtime protection. |
| 6 | +--- |
| 7 | + |
| 8 | +import useBaseUrl from '@docusaurus/useBaseUrl'; |
| 9 | + |
| 10 | +<img src={useBaseUrl('img/integrations/misc/sysdig-logo.png')} alt="thumbnail icon" width="125"/> |
| 11 | + |
| 12 | +The Sumo Logic app for Sysdig Secure integrates Sysdig Secure’s security insights with Sumo Logic's powerful analytics to help security teams monitor and protect Kubernetes and containerized environments. It provides real-time visibility into vulnerabilities, compliance, and threats by analyzing security events from various sources such as Kubernetes clusters, container registries, and runtime environments. With it's intuitive dashboards, Sysdig Secure helps security professionals understand risks, assess vulnerability impact, and monitor runtime behavior to detect threats before they affect production environments. By centralizing data and presenting it through clear visualizations, the app enables effective collaboration, proactive defense, faster remediation, and continuous compliance in dynamic, containerized environments. |
| 13 | + |
| 14 | +:::info |
| 15 | +This app includes [built-in monitors](#sysdig-secure-monitors). For details on creating custom monitors, refer to [Create monitors for Sysdig Secure app](#create-monitors-for-sysdig-secure-app). |
| 16 | +::: |
| 17 | + |
| 18 | +## Log types |
| 19 | + |
| 20 | +This app uses Sumo Logic’s [Sysdig Secure Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sysdig-secure-source/) to collect the detected open vulnerabilities and active assets from the Sysdig Secure platform. |
| 21 | + |
| 22 | +### Sample log messages |
| 23 | + |
| 24 | +<details> |
| 25 | +<summary>Runtime Scan</summary> |
| 26 | + |
| 27 | +```json |
| 28 | +{ |
| 29 | + "mainAssetName": "mcr.microsoft.com/azure-policy/policy-kubernetes-addon-prod:1.10.1", |
| 30 | + "policyEvaluationResult": "failed", |
| 31 | + "resourceId": "sha256:73fce251be0bb71b38a642a3eed2831e5cb26e02f49023bf89fa76ce7ab2ca7d", |
| 32 | + "resultId": "18393741b66ab761884752af58d8ac32", |
| 33 | + "runningVulnTotalBySeverity": { |
| 34 | + "critical": 0, |
| 35 | + "high": 0, |
| 36 | + "low": 0, |
| 37 | + "medium": 0, |
| 38 | + "negligible": 0 |
| 39 | + }, |
| 40 | + "sbomId": null, |
| 41 | + "scope": { |
| 42 | + "asset.type": "workload", |
| 43 | + "kubernetes.cluster.name": "gke-alliances-test", |
| 44 | + "kubernetes.namespace.name": "kube-system", |
| 45 | + "kubernetes.pod.container.name": "konnectivity-agent-metrics-collector", |
| 46 | + "kubernetes.workload.name": "konnectivity-agent", |
| 47 | + "kubernetes.workload.type": "deployment", |
| 48 | + "workload.name": "konnectivity-agent", |
| 49 | + "workload.orchestrator": "kubernetes" |
| 50 | + }, |
| 51 | + "vulnTotalBySeverity": { |
| 52 | + "critical": 0, |
| 53 | + "high": 1, |
| 54 | + "low": 1, |
| 55 | + "medium": 0, |
| 56 | + "negligible": 0 |
| 57 | + } |
| 58 | +} |
| 59 | +``` |
| 60 | +</details> |
| 61 | + |
| 62 | +<details> |
| 63 | +<summary>Full Scan of Vulnerability</summary> |
| 64 | + |
| 65 | +```json |
| 66 | +{ |
| 67 | + "_resultId": "18392a48e55ef07e827e47719a5295d1", |
| 68 | + "_resourceId": "1489835514684399099", |
| 69 | + "assetType": "host", |
| 70 | + "stage": "runtime", |
| 71 | + "metadata": { |
| 72 | + "architecture": "x86_64", |
| 73 | + "hostId": "1489835514684399099", |
| 74 | + "hostName": "eksa-vsphere-conformitron-md-0-28n7h-vzqdk", |
| 75 | + "os": "bottlerocket 1.26.1" |
| 76 | + }, |
| 77 | + "vulnerability": { |
| 78 | + "c360bd86-4f6d-49bf-b9ce-9fa26d2e4eac": { |
| 79 | + "cisaKev": {}, |
| 80 | + "cvssScore": { |
| 81 | + "score": 5.5, |
| 82 | + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", |
| 83 | + "version": "3.1" |
| 84 | + }, |
| 85 | + "disclosureDate": "2024-11-19", |
| 86 | + "exploitable": false, |
| 87 | + "fixVersion": "6.1.128", |
| 88 | + "mainProvider": "bottlerocket", |
| 89 | + "name": "CVE-2024-50304", |
| 90 | + "packageRef": "ebe6d690-3753-4749-8001-b5391b9ba0a3", |
| 91 | + "providersMetadata": { |
| 92 | + "amazon": { |
| 93 | + "publishDate": "2025-02-12T22:57:00Z" |
| 94 | + }, |
| 95 | + "euleros": { |
| 96 | + "publishDate": "2025-02-08T14:57:02Z" |
| 97 | + }, |
| 98 | + "first.org": { |
| 99 | + "epssScore": { |
| 100 | + "score": 0.00045, |
| 101 | + "percentile": 0.13532, |
| 102 | + "timestamp": "2025-04-23T00:00:00Z" |
| 103 | + } |
| 104 | + }, |
| 105 | + "nvd": { |
| 106 | + "publishDate": "2024-11-19T18:15:22.343Z", |
| 107 | + "cvssScore": { |
| 108 | + "version": "3.1", |
| 109 | + "score": 5.5, |
| 110 | + "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" |
| 111 | + }, |
| 112 | + "severity": "medium" |
| 113 | + }, |
| 114 | + "rhel": { |
| 115 | + "publishDate": "2024-11-19T00:00:00Z", |
| 116 | + "cvssScore": { |
| 117 | + "version": "3.1", |
| 118 | + "score": 5.5, |
| 119 | + "vector": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" |
| 120 | + }, |
| 121 | + "severity": "medium" |
| 122 | + }, |
| 123 | + "ubuntu": { |
| 124 | + "publishDate": "2024-11-19T18:15:00Z" |
| 125 | + }, |
| 126 | + "vulndb": { |
| 127 | + "publishDate": "2024-11-19T00:00:00Z" |
| 128 | + } |
| 129 | + }, |
| 130 | + "riskAcceptRefs": null, |
| 131 | + "severity": "medium", |
| 132 | + "solutionDate": "2025-02-25" |
| 133 | + } |
| 134 | + } |
| 135 | +} |
| 136 | +``` |
| 137 | +</details> |
| 138 | + |
| 139 | +<details> |
| 140 | +<summary>Full Scan of Package</summary> |
| 141 | + |
| 142 | +```json |
| 143 | +{ |
| 144 | + "_resultId": "18392a48e55ef07e827e47719a5295d1", |
| 145 | + "_resourceId": "1489835514684399099", |
| 146 | + "assetType": "host", |
| 147 | + "stage": "runtime", |
| 148 | + "metadata": { |
| 149 | + "architecture": "x86_64", |
| 150 | + "hostId": "1489835514684399099", |
| 151 | + "hostName": "eksa-vsphere-conformitron-md-0-28n7h-vzqdk", |
| 152 | + "os": "bottlerocket 1.26.1" |
| 153 | + }, |
| 154 | + "package": { |
| 155 | + "8edec454-c929-49b0-86e8-d72412592109": { |
| 156 | + "isRemoved": false, |
| 157 | + "isRunning": false, |
| 158 | + "name": "google.golang.org/grpc", |
| 159 | + "path": "/usr/bin/containerd-shim", |
| 160 | + "type": "golang", |
| 161 | + "version": "v1.59.0", |
| 162 | + "vulnerabilitiesRefs": null |
| 163 | + } |
| 164 | + } |
| 165 | +} |
| 166 | +``` |
| 167 | +</details> |
| 168 | + |
| 169 | +### Sample queries |
| 170 | + |
| 171 | +```sql title="Total Running Critical Severity Vulnerabilities" |
| 172 | +_sourceCategory=Labs/SysdigSecure mainAssetName |
| 173 | +| json "mainAssetName", "resourceId", "runningVulnTotalBySeverity.critical","vulnTotalBySeverity.critical", "runningVulnTotalBySeverity.high", "vulnTotalBySeverity.high", "runningVulnTotalBySeverity.medium", "vulnTotalBySeverity.medium", "runningVulnTotalBySeverity.low", "vulnTotalBySeverity.low", "runningVulnTotalBySeverity.negligible", "vulnTotalBySeverity.negligible", "policyEvaluationResult", "$['scope']['asset.type']", "$['scope']['kubernetes.cluster.name']", "$['scope']['workload.name']", "$['scope']['kubernetes.workload.type']" as asset_name, resource_id, running_critical_vuln, total_critical_vuln, running_high_vuln, total_high_vuln, running_medium_vuln, total_medium_vuln, running_low_vuln, total_low_vuln, running_negligible_vuln, total_negligible_vuln, policy_result, asset_type, kubernete_cluster, workload_name, kubernete_workload_type nodrop |
| 174 | + |
| 175 | +// global filters |
| 176 | +| where asset_type matches "{{asset_type}}" |
| 177 | +| where policy_result matches "{{policy_evaluation_result}}" |
| 178 | +| where kubernete_cluster matches "{{kubernete_cluster}}" |
| 179 | + |
| 180 | +// panel specific |
| 181 | +| where !isNull(asset_name) |
| 182 | +| first(running_critical_vuln) as running_critical_vuln group by asset_name, resource_id |
| 183 | +| sum(running_critical_vuln) |
| 184 | +``` |
| 185 | + |
| 186 | +```sql title="Resources by Package Count" |
| 187 | +_sourceCategory=sysdig_secure_app |
| 188 | +| json "_resourceId", "assetType", "metadata.os", "metadata.architecture", "vulnerability", "package" as resource_id, asset_type, os, architecture, vuln, package nodrop |
| 189 | +| extract field=vuln "\"severity\":\s*\"(?<severity>[^\"]+)\"" nodrop |
| 190 | +| extract field=vuln "\"exploitable\":\s*(?<exploitable>true|false)" nodrop |
| 191 | +
|
| 192 | +// global filters |
| 193 | +| where os matches "{{os}}" |
| 194 | +| where architecture matches "{{architecture}}" |
| 195 | +| where isBlank(severity) or severity matches "{{severity}}" |
| 196 | +| where isBlank(exploitable) or exploitable matches "{{exploitable_vuln}}" |
| 197 | +
|
| 198 | +// panel specific |
| 199 | +| where !isNull(asset_type) and !isBlank(package) |
| 200 | +| count as package_count by resource_id |
| 201 | +| sort by package_count |
| 202 | +``` |
| 203 | +
|
| 204 | +## Collection configuration and app installation |
| 205 | +
|
| 206 | +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; |
| 207 | +
|
| 208 | +<CollectionConfiguration/> |
| 209 | +
|
| 210 | +:::important |
| 211 | +Use the [Cloud-to-Cloud Integration for Sysdig Secure](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/sysdig-secure-source/) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Sysdig Secure app is properly integrated and configured to collect and analyze your Sysdig Secure data. |
| 212 | +::: |
| 213 | +
|
| 214 | +### Create a new collector and install the app |
| 215 | +
|
| 216 | +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; |
| 217 | +
|
| 218 | +<AppCollectionOPtion1/> |
| 219 | +
|
| 220 | +### Use an existing collector and install the app |
| 221 | +
|
| 222 | +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; |
| 223 | +
|
| 224 | +<AppCollectionOPtion2/> |
| 225 | +
|
| 226 | +### Use an existing source and install the app |
| 227 | +
|
| 228 | +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; |
| 229 | +
|
| 230 | +<AppCollectionOPtion3/> |
| 231 | +
|
| 232 | +## Viewing the Sysdig Secure dashboards |
| 233 | +
|
| 234 | +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; |
| 235 | +
|
| 236 | +<ViewDashboards/> |
| 237 | +
|
| 238 | +### Runtime Scan |
| 239 | +
|
| 240 | +The **Sysdig Secure - Runtime Scan** dashboard provides real-time insights into the security posture of assets and Kubernetes environments during runtime. It aggregates data from Sysdig Secure’s runtime scanning API, allowing users to monitor active threats and vulnerabilities in running assets. Key features highlight vulnerabilities, track security events such as privilege escalations, and identify compliance violations. By presenting detailed information on runtime risks and potential attack vectors, the dashboard helps security professionals effectively mitigate threats and maintain secure, compliant environments.<br/><img src='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Sysdig+Secure/Sysdig+Secure+-+Runtime+Scan.png' alt="Runtime-Scan" /> |
| 241 | +
|
| 242 | +### Full Scan |
| 243 | +
|
| 244 | +The **Sysdig Secure - Full Scan** dashboard serves as a strategic assessment tool, providing detailed information on asset packages and vulnerabilities based on results from the runtime scan API. It illustrates asset evolution over time and their distribution across operating systems and architectures. The dashboard also highlights the most frequent vulnerabilities, exploitable vulnerabilities, and detailed package data. By identifying the most at-risk assets, it supports the maintenance of a robust and secure infrastructure.<br/><img src='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Sysdig+Secure/Sysdig+Secure+-+Full+Scan.png' alt="Full-Scan" /> |
| 245 | +
|
| 246 | +## Create monitors for Sysdig Secure app |
| 247 | +
|
| 248 | +import CreateMonitors from '../../reuse/apps/create-monitors.md'; |
| 249 | +
|
| 250 | +<CreateMonitors/> |
| 251 | +
|
| 252 | +### Sysdig Secure monitors |
| 253 | +
|
| 254 | +| Name | Description | Trigger Type (Critical / Warning / MissingData) | Alert Condition | |
| 255 | +|:--|:--|:--|:--| |
| 256 | +| `Sysdig Secure - Critical Vulnerabilities` | This alert is triggered when the assets with 5 or more critical severity vulnerabilities are highlighted. | Critical | Count >= 5 | |
| 257 | +
|
| 258 | +## Upgrading the Sysdig Secure app (Optional) |
| 259 | +
|
| 260 | +import AppUpdate from '../../reuse/apps/app-update.md'; |
| 261 | +
|
| 262 | +<AppUpdate/> |
| 263 | +
|
| 264 | +## Uninstalling the Sysdig Secure app (Optional) |
| 265 | +
|
| 266 | +import AppUninstall from '../../reuse/apps/app-uninstall.md'; |
| 267 | +
|
| 268 | +<AppUninstall/> |
0 commit comments