33 lines
2.4 KiB
JSON
33 lines
2.4 KiB
JSON
{
|
|
"category": "file",
|
|
"cluster": "k8s-yc-techno-stage",
|
|
"container": "itsec-pipeline-scanner",
|
|
"containerid": "b0f8865c5ea4d9f21861e39497f046dc92eaeadbe9c3b9e926f27f5bd5dbdef2",
|
|
"data": "{\"timestamp\":1717490469193,\"time\":1717490469,\"subtype\":\"alert\",\"user\":\"0\",\"uid\":\"0\",\"action\":\"exec\",\"command\":\"git clone -b master https://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@github.lmru.tech/adeo/lmru--hr--intraru--currency repo_folder\",\"image\":\"docker-security.art.lmru.tech/itsec-pipeline-scanner-test:37\",\"imageid\":\"328b125da6657b0d0910f5906766cfac05bb22276ec61ed8e9c1fb45bbe12589\",\"container\":\"itsec-pipeline-scanner\",\"containerid\":\"b0f8865c5ea4d9f21861e39497f046dc92eaeadbe9c3b9e926f27f5bd5dbdef2\",\"host\":\"s-shared-ks-application-nodes-d421333b-5647f-c6qx9\",\"hostip\":\"172.16.1.83\",\"hostid\":\"eb49f2d4-0569-4507-991e-bc17df1c4e1f\",\"hostgroup\":\"enforcer-shared-stage\",\"category\":\"file\",\"resource\":\"/usr/bin/git\",\"process\":\"/usr/local/bin/python3.10\",\"pid\":17,\"ppid\":1,\"rule\":\"Aqua default runtime policy\",\"rule_type\":\"runtime.policy\",\"result\":3,\"level\":\"detect\",\"reason\":\"Cryptocurrency mining detection\",\"severity\":4,\"control\":\"Block Cryptocurrency Mining\",\"podname\":\"itsec-pipeline-scanner-job-1-d4kdt\",\"podnamespace\":\"aqua\",\"podtype\":\"container\",\"podjob\":\"itsec-pipeline-scanner-job\",\"k8s_cluster\":\"k8s-yc-techno-stage\",\"tactic\":\"Defense Evasion\",\"technique\":\"Resource Hijacking\"}",
|
|
"event_category": "incident",
|
|
"guid": "5044fa93-7375-4728-af40-d3e02048d2ad",
|
|
"host": "s-shared-ks-application-nodes-d421333b-5647f-c6qx9",
|
|
"host_group": "enforcer-shared-stage",
|
|
"hostid": "eb49f2d4-0569-4507-991e-bc17df1c4e1f",
|
|
"id": 806808,
|
|
"image": "docker-security.art.lmru.tech/itsec-pipeline-scanner-test:37",
|
|
"last_occur_time": 1717490469193,
|
|
"main_category": "runtime",
|
|
"name": "Block Cryptocurrency Mining",
|
|
"postee": {
|
|
"AquaServer": ""
|
|
},
|
|
"response_policy_name": "Test policy-1",
|
|
"result": 3,
|
|
"severity": "critical",
|
|
"severity_score": 4,
|
|
"source": "",
|
|
"source_id": "",
|
|
"suppressed_count": 0,
|
|
"time": 1717490469,
|
|
"timestamp": 1717490469193,
|
|
"type": "Runtime",
|
|
"url": "https://aquasec-stage.lmru.tech/#/alerts/details/5044fa93-7375-4728-af40-d3e02048d2ad/summary",
|
|
"user_response": "{}"
|
|
}
|