Skip to content

Commit 48091ba

Browse files
benironsidebenironside
committed
serverless doc updates
1 parent 2254abc commit 48091ba

File tree

7 files changed

+183
-2
lines changed

7 files changed

+183
-2
lines changed

‎docs/serverless/cloud-native-security/aws-securityhub.asciidoc‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
[[ingest-aws-securityhub-data]]
2+
= Ingest AWS Security Hub data
3+
4+
In order to enrich your {elastic-sec} workflows with third-party cloud security posture data collected by AWS Security Hub:
5+
6+
* Follow the steps to {integrations-docs}/aws/securityhub[set up the AWS Security Hub integration].
7+
8+
* Make sure the integration version is at least 2.31.1.
9+
10+
* Ensure you have `read` privileges for the `security_solution-*.misconfiguration_latest` index.
11+
12+
* While configuring the AWS Security Hub integration, turn on **Collect AWS Security Hub Findings from AWS**. We recommend you also set the **Initial Interval** value to `2160h` (equivalent to 90 days) to ingest existing logs.
13+
14+
image::images/aws-config-finding-logs.png[AWS Security Hub integration settings showing the findings toggle]
15+
16+
After you've completed these steps, AWS Security Hub data will appear on the Misconfigurations tab of the <<security-cspm-findings-page, Findings>> page.
17+
18+
Any available findings data will also appear in the entity details flyouts for related <<insights-section, alerts>>. If alerts are present for a user or host that has findings data from AWS Security Hub, the findings will appear on the <<security-users-page-user-details-flyout,users>>, and <<security-hosts-overview-host-details-flyout,hosts>> flyouts.

‎docs/serverless/cloud-native-security/cspm-findings-page.asciidoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
preview:[]
1212

13-
The **Misconfigurations** tab on the Findings page displays the configuration risks identified by the <<security-cspm,CSPM>> and <<security-kspm,KSPM>> integrations.
13+
The **Misconfigurations** tab on the Findings page displays the configuration risks identified by the <<security-cspm,CSPM>> and <<security-kspm,KSPM>> integrations, as well as data from <<ingest-third-party-cloud-security-data, third-party integrations>>.
1414

1515
[role="screenshot"]
1616
image::images/findings-page/-cloud-native-security-findings-page.png[Findings page]

‎docs/serverless/cloud-native-security/falco-setup.asciidoc‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
[[ingest-falco]]
2+
= Ingest CNCF Falco data
3+
4+
CNCF Falco is an open-source runtime security tool that detects anomalous activity in Linux hosts, containers, Kubernetes, and cloud environments. You can ingest Falco alerts into {es} to view them on {elastic-sec}'s Alerts page and incorporate them into your security workflows by using Falcosidekick, a proxy forwarder which can send alerts from your Falco deployments to {es}.
5+
6+
First, you'll need to configure {elastic-sec} to receive data from Falco, then you'll need to configure Falco and Falcosidekick to send data to {es}.
7+
8+
[discrete]
9+
[[ingest-falco-setup-kibana]]
10+
== Configure {elastic-sec} to receive Falco data
11+
12+
In {elastic-sec}:
13+
14+
. Click **Add integrations**.
15+
. Search the Integrations page for `Falco`, then select it.
16+
. Go to the Falco integration's **Settings** tab.
17+
. Click **Install Falco**, then confirm by clicking **Install Falco** again. Installation should take less than a minute.
18+
19+
{elastic-sec} is now ready to receive data from Falco. The Falco integration page now has an **Assets** tab where you can inspect the newly installed assets that help to ingest Falco data.
20+
21+
Next, to make alerts from Falco appear on {elastic-sec}'s Alerts page:
22+
23+
. Find the **Rules** page in the navigation menu or by using the {kibana-ref}/introduction.html#kibana-navigation-search[global search field].
24+
. Click **Detection rules (SIEM)**.
25+
. Search for a rule called `External Alerts`. Install it if necessary, and enable it.
26+
27+
28+
[discrete]
29+
[[ingest-falco-setup-falco]]
30+
== Configure Falco and Falcosidekick
31+
32+
You can either:
33+
34+
* <<ingest-falco-setup-falco-vm,Send Falco data to {es} from virtual machines (VMs)>>; or,
35+
* <<ingest-falco-setup-falco-kubernetes,Send Falco data to {es} from Kubernetes>>.
36+
37+
[discrete]
38+
[[ingest-falco-setup-falco-vm]]
39+
=== Configure Falco and Falcosidekick for VMs
40+
41+
Multiple methods for configuring Falco to send data from VMs to {es} are available. This guide uses the https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/elasticsearch.md[Falco sidekick on Docker using environment variables] method.
42+
43+
[discrete]
44+
=== Configure Falco for VMs:
45+
46+
. Refer to Falco's documentation to https://falco.org/docs/setup/packages/[install Falco on the Linux VMs you wish to monitor].
47+
. Once Falco is installed, update `/etc/falco/falco.yaml` as follows:
48+
.. Enable JSON output: `json_output: true`
49+
.. Enable HTTP output: under `http_output`, for the `url` value, enter the `url:port` where Falcosidekick will listen. For example, if Falcosidekick is running on localhost:
50+
+
51+
```
52+
http_output:
53+
enabled: true
54+
url: "http://0.0.0.0:2801/"
55+
```
56+
57+
[discrete]
58+
[[falco-config-falco-for-vms]]
59+
=== Configure Falcosidekick for VMs:
60+
61+
. Refer to Falcosidekick's documentation to https://github.com/falcosecurity/falcosidekick?tab=readme-ov-file#installation[install Falcosidekick].
62+
. Use the https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/elasticsearch.md[Falcosidekick on Docker using environment variables] method and set your environment variables as follows:
63+
.. `ELASTICSEARCH_HOSTPORT`: Your {es} endpoint URL, which can be found under **Connection details** on the upper right of the **Integrations** page in {kib}.
64+
.. `ELASTICSEARCH_INDEX`: The {es} index where you want to store Falco logs.
65+
+
66+
IMPORTANT: Your `ELASTICSEARCH_INDEX` value must match `logs-falco.alerts-*`.
67+
+
68+
.. `ELASTICSEARCH_SUFFIX`: The frequency with which you want the {es} index suffix to change. Either `daily`, `monthly`, `annually`, or `none`.
69+
.. `ELASTICSEARCH_APIKEY`: The recommended way to authenticate to {es}, by providing an {kibana-ref}/api-keys.html[API key]. Note that support for this environment variable starts with Falcosidekick version 2.30. You can access the latest version on Falcosidekick's https://hub.docker.com/r/falcosecurity/falcosidekick[Docker Hub].
70+
.. `ELASTICSEARCH_USERNAME` and `ELASTICSEARCH_PASSWORD`: The username and password for an account on your {es} instance. Authentication using these environment variables is not supported on {ecloud} Serverless.
71+
.. `ELASTICSEARCH_MUTUALTLS` and `ELASTICSEARCH_CHECKCERT`: For security reasons, we recommend setting these to `true`.
72+
73+
For example:
74+
75+
```
76+
docker run -d -p 2801:2801
77+
-e ELASTICSEARCH_HOSTPORT=https://test-falco.es.us-west2.gcp.elastic-cloud.com
78+
-e ELASTICSEARCH_INDEX=logs-falco.alerts-all
79+
-e ELASTICSEARCH_SUFFIX=none
80+
-e ELASTICSEARCH_APIKEY=XXXXXXXXXXXXX
81+
-e ELASTICSEARCH_MUTUALTLS=true
82+
-e ELASTICSEARCH_CHECKCERT=true falcosecurity/falcosidekick
83+
```
84+
85+
IMPORTANT: The {es} account used to authenticate Falcosidekick only needs sufficient privileges to create and write to new indices. We recommend following the principle of least privilege when provisioning this account.
86+
87+
After installing and configuring Falcosidekick, restart Falco with `sudo systemctl restart falco`. Falcosidekick should start sending alerts to {es}.
88+
89+
90+
[discrete]
91+
[[ingest-falco-setup-falco-kubernetes]]
92+
== Configure Falco and Falcosidekick for Kubernetes
93+
94+
1. Add the Falco https://github.com/falcosecurity/charts/blob/master/README.md[Helm charts]:
95+
+
96+
```
97+
helm repo add falcosecurity https://falcosecurity.github.io/charts
98+
helm repo update
99+
```
100+
+
101+
2. Next, install Falco and Falcosidekick using the `falcosecurity/falco` Helm chart with https://github.com/falcosecurity/falcosidekick/blob/master/docs/outputs/elasticsearch.md[appropriate values] for each of the `falcosidekick.config.elasticsearch.*` fields:
102+
+
103+
```
104+
helm install falco falcosecurity/falco \
105+
--set falcosidekick.enabled=true \
106+
--set tty=true \
107+
--set driver.kind=modern_ebpf \
108+
--set collectors.kubernetes.enabled=true \
109+
--set falcosidekick.config.elasticsearch.hostport="https://<ES host>" \
110+
--set falcosidekick.config.elasticsearch.username="<elastic>" \
111+
--set falcosidekick.config.elasticsearch.password="<password>" \
112+
--set falcosidekick.config.elasticsearch.index="logs-falco.alerts-all" \
113+
--set falcosidekick.config.elasticsearch.suffix="none"
114+
```
115+

‎docs/serverless/cloud-native-security/ingest-cncf-data.asciidoc‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
[[ingest-third-party-cloud-security-data]]
2+
= Ingest third-party cloud security data
3+
4+
This section describes how to ingest cloud security data from third-party tools into {es}. Once ingested, this data can provide additional context and enrich your {elastic-sec} workflows.
5+
6+
You can ingest both third-party cloud workload protection data and third-party security posture and vulnerability data.
7+
8+
[discrete]
9+
== Ingest third-party workload protection data
10+
11+
You can ingest third-party cloud security alerts into {elastic-sec} to view them on the <<alerts-page>> and incorporate them into your triage and threat hunting workflows.
12+
13+
* Learn to <<ingest-falco, ingest alerts from Sysdig Falco>>.
14+
15+
[discrete]
16+
== Ingest third-party security posture and vulnerability data
17+
18+
You can ingest third-party data into {elastic-sec} to review and investigate it alongside data collected by {elastic-sec}'s native cloud security integrations. Once ingested, cloud security posture and vulnerability data appears on the <<cspm-findings-page,Findings>> page and in the entity details flyouts for <<insights-section, alerts>>, <<user-details-flyout,users>>, and <<host-details-flyout,hosts>>.
19+
20+
* Learn to <<ingest-aws-securityhub-data, ingest cloud security posture data from AWS Security Hub>>.
21+
22+
* Learn to <<ingest-wiz-data, ingest cloud security posture and vulnerability data from Wiz>>.

‎docs/serverless/cloud-native-security/vuln-management-findings.asciidoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
preview:[]
88

9-
The **Vulnerabilities** tab on the Findings page displays the vulnerabilities detected by the <<security-vuln-management-overview,CNVM integration>>.
9+
The **Vulnerabilities** tab on the Findings page displays the vulnerabilities detected by the <<security-vuln-management-overview,CNVM integration>>, as well as those detected by <<ingest-third-party-cloud-security-data, third-party integrations>>.
1010

1111
[role="screenshot"]
1212
image::images/vuln-management-findings/-cloud-native-security-cnvm-findings-page.png[The Vulnerabilities tab of the Findings page]

‎docs/serverless/cloud-native-security/wiz.asciidoc‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
[[ingest-wiz-data]]
2+
= Ingest Wiz data
3+
4+
In order to enrich your {elastic-sec} workflows with third-party cloud security posture and vulnerability data collected by Wiz:
5+
6+
* Follow the steps to {integrations-docs}/wiz[set up the Wiz integration].
7+
8+
* Make sure the integration version is at least 2.0.1.
9+
10+
* Ensure you have `read` privileges for the following indices: `security_solution-*.misconfiguration_latest`, `security_solution-*.vulnerability_latest`.
11+
12+
* While configuring the Wiz integration, turn on **Cloud Configuration Finding logs** and **Vulnerability logs**. We recommend you also set the **Initial Interval** values for both settings to `2160h` (equivalent to 90 days) to ingest existing logs.
13+
14+
image::images/wiz-config-finding-logs.png[Wiz integration settings showing the findings toggle]
15+
16+
image::images/wiz-config-vuln-logs.png[Wiz integration settings showing the vulnerabilities toggle]
17+
18+
After you've completed these steps, Wiz data will appear on the <<security-cspm-findings-page, Misconfiguations>> and <<security-vuln-management-findings, Vulnerabilities>> tabs of the Findings page.
19+
20+
image::images/wiz-findings.png[Wiz data on the Findings page]
21+
22+
Any available findings data will also appear in the entity details flyouts for related <<insights-section, alerts>>. If alerts are present for a user or host that has findings data from Wiz, the findings will appear on the <<security-users-page-user-details-flyout,users>>, and <<security-hosts-overview-host-details-flyout,hosts>> flyouts.

‎docs/serverless/index.asciidoc‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,10 @@ include::./cloud-native-security/d4c-policy-guide.asciidoc[leveloffset=+4]
107107
include::./cloud-native-security/d4c-kubernetes-dashboard-dash.asciidoc[leveloffset=+4]
108108
include::./cloud-native-security/cloud-workload-protection.asciidoc[leveloffset=+3]
109109
include::./cloud-native-security/environment-variable-capture.asciidoc[leveloffset=+4]
110+
include::./cloud-native-security/ingest-cncf-data.asciidoc[leveloffset=+3]
111+
include::./cloud-native-security/falco-setup.asciidoc[leveloffset=+4]
112+
include::./cloud-native-security/aws-securityhub.asciidoc[leveloffset=+4]
113+
include::./cloud-native-security/wiz.asciidoc[leveloffset=+4]
110114

111115
include::./explore/explore-your-data.asciidoc[leveloffset=+2]
112116
include::./explore/hosts-overview.asciidoc[leveloffset=+3]

0 commit comments

Comments
 (0)