Rapid Response

Overview

With Rapid Response, Sysdig has introduced a way to grant designated Advanced Users in Sysdig Secure the ability to remote connect into a host directly from the Event stream and execute desired commands there.

Finding the team or developer responsible for an application in a cloud or Kubernetes environment can take hours or days. Troubleshooting a live issue or security event may require faster investigation, to lower the MTTR of these events.

Rapid Response allows security teams to connect to a remote shell within your environment to start troubleshooting and investigating an event using the commands they are already accustomed to, with the flexibility they need to run the security tools at their disposal, directly from the event alert.

Process Overview

  • Install: Install and configure the Rapid Response container on

    • Sysdig Secure on-premises v4.0+ or
    • Sysdig Secure SaaS

  • Configure Teams: Create or configure team(s) of Sysdig Secure Advanced Users who should have Rapid Response privileges

  • Use: Team members log in and manage workloads using Rapid Response shell.

  • Check logs Review session logs to keep track of what has been done using Rapid Response.

Configure Rapid Response Teams

Rapid Response team members have access to a full shell from within the Sysdig Secure UI. Responsibility for the security of this powerful feature rests with you: your enterprise and your designated employees.

Suppose you have an existing team called CustomerResponse with 40 members and you’d like five of those users to be granted Rapid Response capabilities. You could create a team called, e.g.,CustomerResponse_RR and add the five designated Advanced Users to it.

  1. Create a team or teams, as described here

  2. Add users, assigning them the Advanced User role.

  3. Check the Rapid Response additional permission checkbox

Alternatively, to enable Rapid Response on an existing team, go to Settings > Teams and choose the applicable team. On the resulting Edit Teams page, select the Rapid Response checkbox in the additional permissions section and click Save.

Usage

There are two points of entry to the Rapid Response feature:

  • From the Investigate menu item

  • From the Events feed detail panel

In either case, the user will be prompted to enter a 2FA authentication code generated by Sysdig and sent to the user by email. After entering both that and the password configured for the host, a shell will be spawned.

Launch Session from Investigate Button

  1. Log in the Sysdig Secure UI as a Rapid Response team member.

  2. Select Investigate > Start Rapid Response.

  3. Select the host as prompted and click Start Session.

  4. Enter the password for that host.

  5. Enter the 2FA code that was emailed to your user address and click Confirm.

  6. Begin your session. You can dock the terminal window at the bottom or right panel of your page, or as a separate screen.

Launch Session from Events Detail

  1. Log in the Sysdig Secure UI as a Rapid Response team member.

  2. Select Events and choose an event from the list to open the detail pane. Click Respond: Launch Rapid Response.

  3. Enter the 2FA code that was emailed to your user address and click Confirm.

  4. Begin your session. You can dock the terminal window at the bottom or right panel of your page, or as a separate screen.

Manage Rapid Response Logs

When reviewing the logs, you can download log sessions that have been completed, or close sessions that are live, if needed.

The logs visible to the user depend on the team and role under which they are logged in. Administrators will see the entire log list.

Review Session Log Info

The Session Log list includes the session initiator, the timestamp, and the host name accessed.

Download Session Information

If the session has been closed, the content of the session can be downloaded from the UI (input and output) as an Open SLL-compatible gzip encrypted file.

To open the file, use the following command, where session-file is the name of the downloaded file. <password> is the password you setup for that host during the installation. Note: to run this command OpenSSL >= 1.1.1 is required.

gzip -dc session-file | openssl enc -d -aes-256-ctr -pbkdf2 -k <password>

Note: this feature requires that a custom s3 storage bucket has been properly configured.

Close an Active Session

Any Rapid Response team member can review the Session Log list and close any active session by clicking the Close link.