March 2018 Summaries

The blog post provides a comprehensive comparison between Prometheus monitoring and Sysdig Monitor, two tools used for monitoring Docker and Kubernetes environments. Prometheus is highlighted as a robust open-source tool ideal for individual developers or small teams due to its excellent developer tooling, metrics format, and ability to integrate with custom tooling, whereas Sysdig Monitor is recommended for complex, enterprise-level environments due to its comprehensive metrics support, enterprise-class data management, and user access controls. The post discusses the differences in instrumentation models, data types, scalability, data analysis, and management, emphasizing that Prometheus offers a flexible query language (PromQL), while Sysdig provides a GUI-based approach with built-in features like anomaly detection. Prometheus relies on a vertical scalability model with a local time series database, while Sysdig uses a horizontally scalable architecture with components like Cassandra and Elasticsearch. The post concludes that the choice between the two depends on specific organizational needs, such as monitoring requirements, the preference for building or buying solutions, and data management needs.

Cryptojacking, a form of cyberattack where attackers exploit systems to run cryptocurrency mining software, is a growing concern, as highlighted by incidents involving unsecured Kubernetes dashboards. Sysdig's Falco, an open-source container security monitor, plays a crucial role in detecting such activities by monitoring for anomalies within applications and containers. The blog details how cryptojacking scripts typically infiltrate systems through vulnerabilities, such as unsanitized inputs in Node.js applications, allowing attackers to execute unauthorized code. Falco can be deployed in Kubernetes as a Daemon Set, with customizable rules to identify suspicious activities like connections to common mining pool ports or the use of protocols like stratum+tcp. The article further explains how to create specific rules in Falco to detect these cryptojacking attempts, providing a means to enhance security through real-time alerts and integrations with various log management systems. Additionally, it introduces Sysdig Secure, an advanced solution offering further integrations and capabilities beyond Falco's monitoring, such as container activity auditing and automated responses to detected threats.

Sysdig's Falco is a robust tool for monitoring behavioral activity in applications and containers, designed to detect abnormal behaviors and enhance security through custom-written rules using Sysdig's filter syntax. While it comes with 25 pre-defined rules for common practices, users are encouraged to create custom rules tailored to their needs using the YAML format, which includes elements such as conditions, outputs, and priorities. Falco's ability to alert on abnormal activities, such as unexpected shell executions within containers, is further enhanced by the use of lists to monitor processes. The tool is particularly valuable in containerized and microservices environments, helping ensure compliance with best practices and alerting users to potential system compromises. Additionally, Sysdig offers Sysdig Secure, which provides advanced features like user activity auditing and integration capabilities, allowing for further container management and security measures. For more information, users are directed to the Falco documentation on GitHub or the Sysdig Slack team for community support.

In the blog post, the author discusses how to centralize Kubernetes and Docker events into logging systems like Elasticsearch and Splunk using Sysdig, emphasizing the importance of such integration for incident response and security analysis. The article outlines the use of WebHooks for sending Sysdig events to these platforms, detailing the configuration of notification channels and the necessary preprocessing steps for data compatibility. It highlights the need for WebHook authentication via custom headers, using Sysdig's API to modify notification channels, and emphasizes the significance of adapting time formats to align with the data engines' preferences. The blog further illustrates how to use Elasticsearch and Splunk to build dashboards for visualizing Sysdig Monitor and Sysdig Secure events, showcasing examples of dashboards that display alert severity, event distribution, and metadata segmentation. Finally, the author encourages readers to share their experiences and methods for event collection and visualization through social media and community platforms, while also noting the availability of Sysdig's API and Python libraries for advanced data manipulation.

Sysdig Spotlight is a new feature of Sysdig Monitor designed to enhance efficiency in monitoring by proactively informing users about changes in their environment, such as infrastructure updates, team status, and administrative needs. It simplifies the process of identifying and addressing issues through an Infrastructure Scan panel that provides an overview of the latest status of hosts, containers, and applications, along with health indicators and suggestions for solutions. Spotlight also facilitates onboarding for new team members by automatically displaying environment details and status, thereby reducing the time spent on setting up metrics, dashboards, and alerts. By using Spotlight, both admins and team members can save time and ensure that they are working with up-to-date information, making it easier to maintain smooth operations in dynamic environments managed with tools like Kubernetes.