April 2021 Summaries

Monitoring Microsoft SQL Server with Prometheus can be efficiently achieved using the sql_exporter, which exposes necessary metrics for Prometheus to collect. Leveraging Golden Signals, a reduced set of crucial metrics, helps in detecting potential issues affecting application behavior. Important metrics include checking if the database is operational, identifying deadlocks, and monitoring disk space usage. Custom metrics tailored to specific business needs can also be created, such as tracking total invoiced amounts for e-commerce sites. These metrics can be visualized using dashboards available from PromCat, compatible with Grafana and Sysdig Monitor, offering a comprehensive overview for troubleshooting and optimizing SQL Server instances. Users are encouraged to explore this integration through a free trial of Sysdig Monitor.

ServiceVision for Prometheus, introduced by Sysdig, enhances the process of writing PromQL queries by simplifying their complexity through enriched metrics with Kubernetes, host, and cloud context. This tool automatically generates labels and groups workloads, resulting in more informative dashboards that facilitate faster problem-solving. By integrating Sysdig's patented technology, ServiceVision reduces the need to manually instrument additional labels, thus lowering operational complexity and costs. PromQL queries become easier and more performant as ServiceVision removes the necessity for vector matching operations and label replacement functions, offering backward compatibility with existing queries in Sysdig Monitor. The feature is initially available to customers in the Sysdig US-East region and will be expanded to other regions, with a detailed explanation and demonstration available in an upcoming webinar.

CVE-2021-25735 is a medium-level vulnerability in certain versions of Kubernetes' kube-apiserver that allows unauthorized node updates by bypassing the Validating Admission Webhook. This vulnerability affects kube-apiserver versions v1.20.0 to v1.20.5, v1.19.0 to v1.19.9, and v1.18.17 or earlier when using a Validating Admission Webhook with outdated values. Exploitation allows adversaries to make unauthorized changes to node settings by manipulating node labels, such as "changeAllowed," thereby bypassing admission controls. To address this, affected systems should be upgraded to fixed versions, and detection of exploitation attempts can be achieved using the open-source tool Falco, which requires enabling Kubernetes Audit Logging. Falco can identify suspicious activities by monitoring changes in node labels that could indicate an attempt to exploit this vulnerability. The article emphasizes the importance of upgrading to the latest versions of kube-apiserver and using Falco for monitoring to prevent or detect potential exploitation.

Monitoring Ceph with Prometheus is a straightforward process due to Ceph's native ability to expose metrics, making it easy for users to track the health and performance of their storage clusters. The article outlines the importance of monitoring key metrics such as ceph_health_status, cluster storage usage, Object Storage Daemon (OSD) operations, Metadata Server (MDS) replicas, and quorum status to ensure system reliability. It also highlights the use of PromQL to create alerts for these metrics, which can be visualized in tools like Grafana or Sysdig Monitor. Additionally, the discussion covers essential metrics for understanding latency, saturation, and traffic within the Ceph cluster, emphasizing the value of the Golden Signals framework for detecting and diagnosing potential issues. The article encourages the use of curated dashboards and alerts available on PromCat.io to simplify the setup process and suggests exploring Sysdig Monitor for enhanced monitoring capabilities.

Sysdig's April 2021 update highlights the introduction of Falco Feeds, a feature that enhances the Falco open-source security tool by providing companies with access to expertly crafted, continuously updated rules to address new threats as they emerge. This addition is aimed at improving cloud security by allowing organizations to stay ahead of evolving vulnerabilities. The update emphasizes the importance of leveraging expert knowledge to maintain robust security measures in cloud environments.

The EC2 Serial Console is a feature introduced by Amazon AWS for instances using the Nitro System, allowing for secure and straightforward troubleshooting through a text-based connection to the instance's serial port. While beneficial for resolving boot and network issues, it poses potential security risks as it could serve as an unguarded entry point for attackers if not properly managed. To mitigate these risks, it is essential to enable the feature deliberately, authenticate access through public and private keys, and ensure strong credentials. Tools like Sysdig Secure and AWS CloudTrail can help detect when the EC2 Serial Console is enabled, alert security teams, and monitor suspicious activities, thereby enhancing the security posture of cloud environments.

CVE-2021-20291 is a medium-severity vulnerability found in the containers/storage Go library, affecting container engines like CRI-O (before v1.20.2) and Podman (before v3.1.0), which can lead to a Denial of Service (DoS) when a malicious image layer is introduced and executed within a containerized infrastructure, including Kubernetes and OpenShift. The vulnerability, which scores 6.5 on the CVSS scale, arises when an extra malicious layer is added to an image and uploaded to a registry; upon pulling the image, the engine's execution can result in a deadlock, halting other processes. Mitigation involves upgrading to secure versions of the affected engines and employing best practices such as using private registries and container image signing to ensure the authenticity and integrity of images, along with deploying security tools like Sysdig Secure to monitor and reinforce security posture.

Published on April 15, 2021, by Jesús Ángel Samitier, the blog post "Top 5 key metrics for monitoring Amazon RDS" offers insights into crucial metrics for effectively monitoring Amazon's Relational Database Service (RDS). Although the text snippet does not provide details about the specific metrics discussed, it highlights the importance of expert-written rules that are continuously updated to address new threats, underscoring the significance of robust monitoring and security practices for cloud services.

Falco, a security tool by Sysdig, is designed to detect and mitigate hidden malicious processes in cloud-native environments, such as Kubernetes and containers, which are otherwise challenging to monitor. Malicious actors can exploit open-source tools like libprocesshider to conceal processes using Linux's library preloading technique, making them invisible to standard monitoring tools. Falco addresses this by detecting file modifications, such as changes to /etc/ld.so.preload, and raising alerts for suspicious activities. It leverages system calls to provide insights and can be supplemented with best practices like enabling read-only root filesystems and using AppArmor profiles to prevent tampering. The tool offers real-time visibility into container activities, helping to identify typical malware behaviors and offering a robust defense against evasion tactics in ephemeral container environments.