Response Actions
Spyderbat’s Policy Response Actions provide a powerful mechanism for responding to security events and deviations within your environment. These actions allow you to automate responses, enforce security policies, and maintain operational integrity. Response actions fall under two main categories, Agent and Standard.
Categories of Response Actions
Agent Response Actions:
Purpose: These actions are executed directly on machines where the Spyderbat Nano Agent is installed.
Targeted Scope: They allow for machine-specific responses.
Examples:
Kill a process.
Kill a pod.
Standard Response Actions:
Purpose: These actions generate security and operations flags.
Insights: They provide visibility into policy violations or anomalies. They serve as alerts that can be further processed by other systems or personnel.
Examples:
Creating red flags. (Security focused, can trigger Spydertraces)
Creating operations flags. (Operations focused, highlight potential problems with infrastructure)
Actions
Response actions are defined within the spec field of policies.
For Example:
The default section contains global actions that apply to the entire policy. Whenever a deviation occurs, default actions are taken if applicable.
The actions section allows you to define more specific actions with selectors that narrow the scope of when the action should be executed.
makeRedFlag Action
This action makes a security flag. The ultimate consumer of these types of flags are security personnel investigating an anomaly. They can trigger spydertraces and/or be used to trigger notifications.
Supported Selectors |
---|
Cluster |
Machine |
Namespace |
Pod |
Container |
Service |
Fields
severity: The priority level of the red flag. Can be
critical
,high
,medium
,low
, orinfo
.impact: [Optional] A string describing the security impact should the flag be generated.
content: [Optional] A string containing markdown that can detail next steps or who to contact.
Example:
makeOpsFlag Action
This action makes an operations flag. The ultimate consumer of these types of flags are operations personnel responsible for maintaining infrastructure.
Supported Selectors |
---|
Cluster |
Machine |
Namespace |
Pod |
Container |
Service |
Fields
severity: The priority level of the operations flag. Can be
critical
,high
,medium
,low
, orinfo
.impact: [Optional] A string describing the operations impact should the flag be generated.
content: [Optional] A string containing markdown that can detail next steps or who to contact.
Example:
agentKillPod
This action tells the Spyderbat Nano Agent to kill a deviant process.
Supported Selectors |
---|
Cluster |
Machine |
Namespace |
Pod |
Container |
Examples:
Kill pods running deviant netcat processes.
Kill all pods with deviations
agentKillProcess
This action tells the Spyderbat Nano Agent to kill a deviant process.
Supported Selectors |
---|
Cluster |
Machine |
Namespace |
Pod |
Container |
Service |
Examples:
Kill deviant processes running the /bin/bash executable.
Kill all deviant processes
agentKillProcessGroup
This action kills a process an any other processes within the same process group (pgid).
Supported Selectors |
---|
Cluster |
Machine |
Namespace |
Pod |
Container |
Service |
Examples:
Kill process group of deviant processes running the /bin/bash executable.
Kill all deviant processes and their associated groups.
Related Pages
Last updated