Posture Host Analyzer (Non-Kubernetes)

This page describes how to install the Sysdig Posture Host Analyzer on non-Kubernetes hosts using containers. This is used to scan for compliance violations on stand-alone hosts.

Prerequisites

  • Retrieve your access key to use for ACCESS_KEY.
  • Retrieve Sysdig Secure endpoint by region to use for API_ENDPOINT.
  • Docker installed.
  • Supported Linux distributions:
    • Ubuntu (22.04.2)
    • Debian (11 - bullseye)
    • RHEL 9.2
    • Fedora CoreOS 37.2
  • Supported CPU Architectures:
    • x86_64

Installation

Run the following command to deploy the non-Kubernetes Posture Analyzer on a host as a container:

sudo docker run -d [-e TAGS=<TAGS> -v /:/host:ro -v /tmp:/host/tmp --privileged --network host --pid host --env ACCESS_KEY="xxx"  --env API_ENDPOINT=secure.sysdig.com quay.io/sysdig/kspm-analyzer:latest

  • Replace XXX with your agent access key, and <sysdig-secure-endpoint> with the URL for your Sysdig Secure endpoint by region.

  • If proxy is used, pass the proxy settings by using the following flags:

    -e HTTPS_PROXY=squid.yourdomain.com:PORT -e HTTP_PROXY=squid.yourdomain.com:PORT

Options

Zones

To apply posture with specific zones, the agent and the KSPM components must be in the stand-alone Docker host. (Note that Inventory is based on CSPM resources.) Include the kspm-analyzer container as part of the node-analyzer pod while installing to add standalone Docker hosts in the Host list/ Zones.

Agent Tags

Optionally, add user-defined tags by adding environment variable: -e TAGS=AGENT_TAGS and AGENT_TAGS=myApp.Env:Production,host.name:MyHost

Results

Once the container is running, the analyzer will begin scanning your host for compliance violations and providing security recommendations. You can view the results in the Sysdig Secure UI.

Results will be shown within a few minutes of installation and scans are refreshed every 24 hours.

Next Steps

Use the Posture Host Analyzer in the Sysdig Secure UI