December 2018 Summaries

Sysdig has introduced a new feature set for its cloud-native intelligence platform, designed to streamline the monitoring and security of critical applications by consolidating alerts, Docker, Kubernetes, and custom events into a single event feed. The platform now offers an enhanced events workflow, allowing users to quickly identify and prioritize critical events with a summary view of all events, detailed exploration options, and quick filters based on event type, severity, and status. New severity levels—High, Medium, Low, and Info—have been introduced to provide clarity and ease of monitoring, while status labels have been updated to reflect the lifecycle of alert events, including triggered, resolved, acknowledged, and unacknowledged states. These updates aim to improve event triage and are set for release in December, with further refinements anticipated based on user feedback.

IBM has introduced IBM Cloud Monitoring with Sysdig, a new fully managed service that enhances monitoring capabilities for cloud-native applications on the IBM Cloud. This collaboration with Sysdig aims to provide DevOps and IT teams with comprehensive visibility into their cloud services, particularly in managing ephemeral container-based services and orchestrated microservices like those managed by Kubernetes. The service offers deep insights into containers and processes, capturing events and activities to facilitate quick problem resolution and threat elimination. Users benefit from features such as automatic metrics collection, critical Kubernetes insights, and the ability to manage custom metrics, all while being integrated directly into the IBM Cloud infrastructure. The service is immediately available and offers a 30-day free trial to allow users to explore its functionalities.

Container security orchestration can be effectively managed by integrating Falco, an open-source intrusion detection system, with Splunk Phantom, a security orchestration platform. Falco excels at detecting anomalous runtime activities in container environments, such as unauthorized shell access or suspicious processes, and emits security events that can be processed further. By publishing Falco events into a NATS message broker and using a Function as a Service (FaaS) with Kubeless, these events can be forwarded to Splunk Phantom. Phantom then unifies security events from various sources, enabling the automation of incident response workflows, collaboration, and reporting. This integration allows for a comprehensive security approach, unifying container security operations with broader infrastructure security measures and supporting the creation of a centralized "security control center" for incident management. The article provides a detailed guide on deploying this setup within a Kubernetes cluster, emphasizing the potential of leveraging these tools to enhance container security policies.

The blog post discusses using Falco, an open-source runtime security tool, to identify and respond to malicious IP activity by leveraging continuously updated threat intelligence feeds. It outlines a process where Falco is configured to trigger alerts when connections are made to IPs flagged by multiple security sensors, helping security practitioners not only detect such events but also assess risk and develop organizational policies. Key steps include writing a Falco rule to capture suspicious connections, generating an up-to-date list of malicious IPs using the IPsum feed, updating Falco's configuration to utilize these lists, and testing the setup to ensure proper detection of malicious activities. The approach promotes enhanced security monitoring by offering detailed incident information and enabling effective threat response within containerized environments.