Security event management
This feature is tech preview. Tech preview features may be subject to significant changes before they become GA.
Big picture​
Get alerts on security events in a single dashboard.
Value​
Security events indicate that a threat actor may be present in your Kubernetes cluster. For example, a DNS request to a malicious hostname, a triggered WAF rule, or the opening of a sensitive file. Calico Enterprise provides security engineers and incident response teams with a single dashboard to manage threat alerts. Benefits include:
- A filtered list of critical events with recommended remediation
- Identify impacts on applications
- Understand the scope and frequency of the issue
- Manage alert noise by dismissing events (show/hide)
Before you begin​
Required
Limitations
- Only WAF basic security events. Over time, the dashboard will contain a full range of Calico Enterprise security events.
- You cannot control which users can view or edit the page using fine-grained role-based access controls
Security events dashboard​
In Manager UI, go to Threat defense, Security Events.
UI help​
Event details page
Provides actions to remediate the detection and stop the attack from progressing. For example:
Severity
Calico Enterprise calculates severity (Critical, High, Medium, Low) using a combination of NIST CVSS 3.0 and MITRE IDs.
MITRE IDs
Multiple MITRE IDs may be associated with a security event.
Attack Vector
- Network
- Process
- File
MITRE Tactic (based on the MITRE tactics) includes a specific path, method, or scenario that can compromise cluster security. Valid entries:
| Tactic | Target | Attack techniques |
|---|---|---|
| Initial access | Network | Gain an initial foothold within a network using various entry vectors. |
| Execution | Code in local or remove systems | Control code running on local or remote systems using malicious code. |
| Impact | Systems and data | Disrupt availability or compromise integrity by manipulating business and operational processes. |
| Persistence | Maintain footholds | Maintain access to systems across restarts, credential changes, and other interruptions. |
| Privilege Escalation | Access permissions | Access higher-level permissions on a system or network. |
| Defense Evasion | Avoid detection | Masquerade and hide malware to avoid detection to compromise software, data, scripts, and processes. |
| Discovery | Determine your environment | Gain knowledge about your system and internal network. |
Frequently asked questions​
How is the recommended remediation determined?
The Tigera Security Research team maps MITRE IDs to events and provides the recommended remediation.
Will I see all Calico Enterprise alerts in this dashboard?
No. Calico Enterprise security events do not encompass all types of alerts nor all security alert types; they only contain alerts for threats. Alerts for vulnerabilities detected in a container image, or misconfigurations in your Kubernetes cluster, are displayed in their respective dashboards. However, when vulnerabilities or misconfigurations are exploited by an attacker, those indicators of an attack are considered security events.
What does dismissing a security event do?
Dismissing a security event hides it from view.
Why are some fields in columns blank?
Security events generated from older managed clusters will not have values for the new fields (for example, MITRE IDs). You can dismiss these events.
Where can I view security event logs?
Go to: Logs, Kibana index, tigera_secure_ee_events.