Integrations for Sysdig Secure

• 1: Data Sources
• 1.1: Cloud Accounts
• 1.2: Managed Kubernetes
• 1.3: Sysdig Agents
• 2: Risk Spotlight Integrations (Controlled Availability)
• 2.1: Integrate Effective Vulnerability Exposure with Snyk
• 3: IBM Cloud Pak for Multicloud Management

1 - Data Sources

Data sources, grouped under Integrations in Sysdig Secure, provide an overview of inbound, outbound, and third-party data integrations.

1.1 - Cloud Accounts

If you connect a cloud account using Sysdig Secure for cloud, you can review the details on this page and connect additional accounts as needed.

Review Data Sources

Access the Page

1. Log in to Sysdig Secure and select Integrations > Data Sources | Cloud Accounts from the navigation bar.

2. The Cloud Accounts overview is displayed.

Review Cloud Accounts

Use the Cloud Accounts overview to:

• Confirm that the incoming data sources you expected are present
• Get an overview of the status
• Check whether managed clusters in the accounts were detected and whether an agent was installed with them.

The page lists:

• Platform: AWS, GCP, Azure

• Account ID: The AWS Account ID, GCP Project ID, or Azure Subscription ID

• Alias: As defined when connected

• Region(#): Each account may be deployed in multiple regions; click on a numbered entry to expand and view all the regions.

• Date Added: Date the account was added to Sysdig Secure

• Date Last Seen: Date of last observed activity on the account/region.

• Clusters Connected (x/y): This displays the number of managed clusters detected in the account/region (y) and the number of clusters with at least one agent installed (x).

  For example:

  • 0/0 = no clusters contain an agent, no clusters detected
  • 1/17 = 1 cluster contains an agent, 17 total clusters detected

Connect Account

To connect a cloud account, click Connect Account and select the appropriate cloud provider (AWS | GCP | Azure), then follow the installation pop-up wizard.

See also: Installation | Sysdig Secure for Cloud

1.2 - Managed Kubernetes

Review Managed Kubernetes

From the Managed Kubernetes tab you can review cluster details of detected cloud accounts and instrument a cluster if needed.

Filtering Actions

You can:

• Search by keyword
• Filter by platform or account number
• Sort by Status, Cluster Name, Account ID, or Region

Use Instrumentation Modal

For un-instrumented clusters detected on an account, the modal under More helps speed the instrumentation process.

1. Click Instructions to Instrument. The instrumentation popup is displayed, with your access key and cluster-specific data prefilled.

   

2. Follow the two-step procedure to generate the kubeconfig and install the agent.

   OR

   Click Copy Script to Instrument to get both parts in a single script you can deploy.

1.3 - Sysdig Agents

This page shows all of the Sysdig Agents that have reported into the Sysdig backend, and enables the user to quickly determine:

• Which agents are up-to-date, out of date, or approaching being out of date
• Which managed clusters have been detected in your cloud environment, but have not yet been instrumented with the Sysdig agent

The feature is in Technology Preview status; additional functionality and refined the workflows will continue to be added.

Review Environment

Select Integrations > Data Sources | Sysdig Agents.

The resulting page shows all detected nodes in your environment and the status of the agents installed on them, or not. The view shows nodes detected from previously installed agents on hosts and from connected cloud accounts.

You can:

• See at a Glance: Quickly identify where agents are installed: by node, cluster name, and/or cloud account ID
• Know the Status: Check agent connection status and age
• Search or Filter: Narrow the view by searching or filtering on node name, cluster name, Account ID, agent version, or agent Status
• Agent Count: View your total connected agent count over time
• Install or Troubleshoot: Link to quick steps for adding an agent or troubleshooting disconnected nodes

Understand Agent Status

Options to Add Agent

1. Integrations > Data Sources | Sysdig Agents and select Add Agent.

   

2. Select whether to connect to a Kubernetes cluster, Linux, or Docker, and follow the installation pop-up instructions.

   

   See also: Agent Installation.

2 - Risk Spotlight Integrations (Controlled Availability)

Sysdig is developing a simplified way to integrate third-party tools with Effective Vulnerability Exposure (EVE), the technology behind Sysdig’s Risk Spotlight feature.

About Risk Spotlight

Risk Spotlight is based on Effective Vulnerability Exposure (EVE for short), a new technology developed by Sysdig that combines the observed runtime behaviour of a particular container image with vulnerabilities detected in its software packages. This combination is used to determine which packages are effectively loaded during the executing and thus, are a more direct security threat for your infrastructure.

Prioritizing the vulnerabilities which represent an actual risk to the organization is one of the most critical aspects of a successful vulnerability management program. Images often contain hundreds of vulnerabilities. Multiplying this by the number of workloads running for any non-trivial infrastructure deployment, it is easy to see that the total number of potential vulnerabilities to fix is actually very large.

There are many prioritization criteria that are commonly used and accepted to start filtering the list (Severity and CVSS scoring, Exploitability metrics, Runtime scope and other environment considerations, etc). EVE is a new criterion, completely supported by observed runtime behaviour, to add to the vulnerability management tool belt that can considerably reduce the working set of vulnerabilities that need to be addressed as a priority.

Technology Overview

The Sysdig Agent components deployed for every instrumented node (host) continuously observe the behaviour of runtime workloads. Some of the information collected includes:

• Image runtime behavior profile: accessed files, processes in execution, system calls, etc. See Profiling for details.
• The ‘Bill Of Materials’ associated with container images used by runtime containers, including used packages and versions and the vulnerabilities matched by those.

By correlating these two pieces of information, Sysdig can differentiate between packages merely installed in the image vs the ones that are loaded at execution time. This information is then propagated to vulnerabilities information.

Enabling the Feature

• Prerequisite: Risk spotlight requires the new Vulnerability Management engine enabled in Sysdig Secure SaaS.
• Precise enablement steps are provided on the Profiling feature page.

Supported Package Formats/Package Managers

• Debian (except Distroless) (deb)
• Alpine (apk)
• RHEL (rpm)
• Ubuntu (deb)
• Amazon Linux
• Java (Maven)
• Python (PyPi)
• NPM (JS)
• Golang (built with Go 1.13+)

Package Types Currently NOT Supported

• Composer (PHP)
• Cargo (Rust)
• Ruby Gems
• NuGet

Currently supported Kubernetes container runtimes:

• Docker daemon
• ContainerD

How to Integrate

Generate a Token for the Integration

1. Select Integrations > 3rd Party|Risk Spotlight Integration. The Spotlight Integration page is displayed, with a list of existing tokens and their expiry dates.

2. Click +Add Token.

   

3. Fill in the attributes and click Create Token.

   • Name: Choose a name that indicates the integration with which the token is associated
   • Expiration: Select an expiration date (1/3/6 months; 1 year)

4. Copy the new token as it is displayed in the list.

   Store the token in a safe place; it will not be visible or recoverable again.

To Renew a token at any time, click the Renew button, reset the expiry, and confirm.

To Delete a token, click the X beside the token name and confirm. This action will sever the integration between Sysdig and the 3rd-party tool.

2.1 - Integrate Effective Vulnerability Exposure with Snyk

Integration with Snyk Overview

Snyk.io vulnerability management workflow can consume runtime EVE information to filter and prioritize detected vulnerabilities, following a similar approach to the one described in Risk Spotlight Integrations.

To integrate Sysdig EVE information with Snyk vulnerability management workflows:

• Have an account and working license to use both products: Snyk, Sysdig Secure
• Instrument the target runtime nodes using both products: Snyk, Sysdig Secure
• Have your Sysdig commercial contact explicitly enable Sysdig EVE for your Sysdig account. In particular, your account needs the feature flags for:
  • Image Profiling
  • Scanning v2 EVE
  • Scanning v2 EVE integration

Both Snyk and Sysdig instrumentation must be in place. Choose the installation path below that corresponds to the components already installed on your infrastructure.

Installation Instructions

Snyk Installed, Sysdig Not Installed

1. Note the namespace you are currently using to run the Snyk instrumentation. Default: snyk-monitor. You will need it to copy the secret in the last step.

2. Use the sysdig-deploy helm chart to install the Sysdig agent bundle. Provide the mandatory parameters and enable the eve and eveConnector parameters.

   Example:

    helm install --namespace sysdig-agent sysdig-agent \
    ....other parameters...
     --set nodeAnalyzer.nodeAnalyzer.runtimeScanner.deploy=true \
     --set nodeAnalyzer.nodeAnalyzer.runtimeScanner.eveConnector.deploy=true \
     --set nodeAnalyzer.nodeAnalyzer.runtimeScanner.settings.eveEnabled=true \
     sysdig/sysdig-deploy
   

3. Make sure the Sysdig agent images, RuntimeScanner, and EveConnector pods are running and healthy:

   kubectl -n sysdig-agent get po

   NAME                                             READY   STATUS    RESTARTS   AGE
   sysdig-agent-8rmkt                               1/1     Running   0          24s
   sysdig-agent-eveconnector-api-74767bbf54-lw97g   1/1     Running   0          23s
   sysdig-agent-hprw7                               1/1     Running   0          24s
   sysdig-agent-jrx2q                               1/1     Running   0          24s
   sysdig-agent-node-analyzer-5hltb                 4/4     Running   0          24s
   sysdig-agent-node-analyzer-b5ftm                 4/4     Running   0          24s
   sysdig-agent-node-analyzer-cd8rc                 4/4     Running   0          24s
   

4. Copy the Sysdig Secret into the Snyk namespace.

   Data can take up to an hour to initialize and start sending the initial profiles, then you should be able to leverage EVE data using Snyk vulnerability management workflows.

Sysdig Installed without EVE, Snyk Not Installed

If you already installed the Sysdig agent using the helm chart without enabling eve and the eveConnector parameters, do the following:

1. Install Snyk instrumentation following its documentation.

2. Upgrade the sysdig-deploy helm chart with the required eve settings:

   helm upgrade sysdig-agent \
     --namespace sysdig-agent \
     --reuse-values \
     --set nodeAnalyzer.nodeAnalyzer.runtimeScanner.deploy=true \
     --set nodeAnalyzer.nodeAnalyzer.runtimeScanner.eveConnector.deploy=true \
     --set nodeAnalyzer.nodeAnalyzer.runtimeScanner.settings.eveEnabled=true \
     sysdig/sysdig-deploy
   

No Sysdig, No Snyk

1. Install the Sysdig agent bundle using the official helm chart, and including the steps and parameters from the first installation scenario.
2. Install Snyk instrumentation following its documentation.
3. Copy the Sysdig Secret into the Snyk namespace.

Copy the Sysdig Secret

Once both Sysdig and Snyk instrumentation are deployed and healthy, you need to copy the secret that was automatically generated in the Sysdig namespace to the Snyk namespace:

Assuming the default namespace names for Sysdig (sysdig-agent) and Snyk (snyk-monitor), replace with your specific values:

kubectl get secret -n sysdig-agent sysdig-eve-secret -o json | jq '{ "apiVersion": .apiVersion, "kind": .kind, "type": .type, "metadata": { "name": .metadata.name }, "data": .data }' | kubectl apply -n snyk-monitor -f -

Check Integration in Snyk UI

Check to confirm that runtime vulnerabilities are detected and prioritized in the Snyk UI:

3 - IBM Cloud Pak for Multicloud Management

IBM Cloud Pak for Multicloud Management centralizes visibility, governance, and automation for containerized workloads across clusters and clouds into a single dashboard. One of the key capabilities of the product is the centralization of security findings to help cloud team administrators understand, prioritize, manage and resolve security issues that are related to their cloud applications and workloads.

The integration of Sysdig Secure with IBM Cloud Pak for Multicloud Management extends the depth of security intelligence available with:

• Container image vulnerability management and configuration validation

• Runtime security with prevention, threat detection, and mitigation

• Incident response and forensics

• Compliance and audit

Sysdig Secure increases IBM Cloud Pak for Multicloud Management compliance capabilities to help meet regulatory requirements like NIST, PCI, GDPR, or HIPAA. By deploying the products together, users can extend container security to prevent vulnerabilities, stop threats, accelerate incident response, and enable forensics.

The integration involves several components, each of which is installed and configured separately.

Users of IBM Cloud Pak for Multicloud Management can follow the Installation Integration Guide to install and configure:

• The Sysdig agent

• Event forwarding integration

• Single sign-on (SSO) integration via OpenID Connect

• Navigation menu shortcut integration

For More Information

• Download the Integration Guide

• Review the blog entry about Sysdig Secure and IBM Cloud Pak for Multicloud Management Integration