{
    "category": "file",
    "cluster": "k8s-yc-techno-stage",
    "container": "itsec-pipeline-scanner",
    "containerid": "b0f8865c5ea4d9f21861e39497f046dc92eaeadbe9c3b9e926f27f5bd5dbdef2",
    "data": "{\"timestamp\":1717490469193,\"time\":1717490469,\"subtype\":\"alert\",\"user\":\"0\",\"uid\":\"0\",\"action\":\"exec\",\"command\":\"git clone -b master https://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@github.lmru.tech/adeo/lmru--hr--intraru--currency repo_folder\",\"image\":\"docker-security.art.lmru.tech/itsec-pipeline-scanner-test:37\",\"imageid\":\"328b125da6657b0d0910f5906766cfac05bb22276ec61ed8e9c1fb45bbe12589\",\"container\":\"itsec-pipeline-scanner\",\"containerid\":\"b0f8865c5ea4d9f21861e39497f046dc92eaeadbe9c3b9e926f27f5bd5dbdef2\",\"host\":\"s-shared-ks-application-nodes-d421333b-5647f-c6qx9\",\"hostip\":\"172.16.1.83\",\"hostid\":\"eb49f2d4-0569-4507-991e-bc17df1c4e1f\",\"hostgroup\":\"enforcer-shared-stage\",\"category\":\"file\",\"resource\":\"/usr/bin/git\",\"process\":\"/usr/local/bin/python3.10\",\"pid\":17,\"ppid\":1,\"rule\":\"Aqua default runtime policy\",\"rule_type\":\"runtime.policy\",\"result\":3,\"level\":\"detect\",\"reason\":\"Cryptocurrency mining detection\",\"severity\":4,\"control\":\"Block Cryptocurrency Mining\",\"podname\":\"itsec-pipeline-scanner-job-1-d4kdt\",\"podnamespace\":\"aqua\",\"podtype\":\"container\",\"podjob\":\"itsec-pipeline-scanner-job\",\"k8s_cluster\":\"k8s-yc-techno-stage\",\"tactic\":\"Defense Evasion\",\"technique\":\"Resource Hijacking\"}",
    "event_category": "incident",
    "guid": "5044fa93-7375-4728-af40-d3e02048d2ad",
    "host": "s-shared-ks-application-nodes-d421333b-5647f-c6qx9",
    "host_group": "enforcer-shared-stage",
    "hostid": "eb49f2d4-0569-4507-991e-bc17df1c4e1f",
    "id": 806808,
    "image": "docker-security.art.lmru.tech/itsec-pipeline-scanner-test:37",
    "last_occur_time": 1717490469193,
    "main_category": "runtime",
    "name": "Block Cryptocurrency Mining",
    "postee": {
        "AquaServer": ""
    },
    "response_policy_name": "Test policy-1",
    "result": 3,
    "severity": "critical",
    "severity_score": 4,
    "source": "",
    "source_id": "",
    "suppressed_count": 0,
    "time": 1717490469,
    "timestamp": 1717490469193,
    "type": "Runtime",
    "url": "https://aquasec-stage.lmru.tech/#/alerts/details/5044fa93-7375-4728-af40-d3e02048d2ad/summary",
    "user_response": "{}"
}