audit alert with resource: unknown for network event
#1838
Comments
7 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Bug Report
General Information
uname -a):CentOS Linux 8, 4.18.0-348.7.1.el8_5.x86_64 amd64kubectl version, ...)To Reproduce
No fixed steps to reproduce the issue, hit and try with a workload that generates network event and observe the alerts using a allow based policy for network events.
Expected behavior
A description of what you expected to happen.
Screenshots
{"Action":"Audit","ClusterName":"TalgarTest","ContainerID":"6ecd86270e501278a7a407fa9a76c5824c55fa2613457e34b346c55564ada11c","ContainerImage":"docker.io/flannel/flannel:v0.25.5@sha256:4f65cc179d15e8ee4d67a6a32ce89c02094120a46452a4e0341d26be9fd556c3","ContainerName":"kube-flannel","Cwd":"/","Data":"lsm=SOCKET_CREATE unknown","Enforcer":"BPFLSM","HostName":"master-k8s","HostPID":3058928,"HostPPID":546359,"Labels":"tier=node,app=flannel","NamespaceName":"kube-flannel","Operation":"Network","Owner":{"Name":"kube-flannel-ds","Namespace":"kube-flannel","Ref":"DaemonSet"},"PID":1733478,"PPID":13,"PodName":"kube-flannel-ds-qm5mg","PolicyName":"DefaultPosture","ProcessName":"/sbin/xtables-nft-multi","Resource":"unknown","Result":"Passed","Source":"/sbin/iptables -t nat -C FLANNEL-POSTRTG ! -s 10.244.0.0/16 -d 10.244.0.0/16 -m comment --comment flanneld masq -j MASQUERADE --random-fully --wait","Timestamp":1723536797,"Type":"MatchedPolicy","UID":0,"UpdatedTime":"2024-08-13T08:13:17.127Z","_id":"66bb159dffa5bde17e93964a","cluster_id":"37390","component_name":"kubearmor","instanceGroup":"0","instanceID":"0","tenant_id":"3632","workload":"1"}If applicable, add screenshots to help explain your problem.
The text was updated successfully, but these errors were encountered: