Host Scanning

A “host” is any runtime entity where you could execute the Sysdig agent, including virtual machines, Kubernetes nodes, bare metal, cloud-managed hosts such as EC2, etc.

Scanning for vulnerabilities on hosts is as important as scanning on containers, and certain standards such as NIST 800-190 require vulnerability reports on running hosts to pass compliance. Sysdig’s host scanning feature provides a unified flow with image scanning, for a smooth user experience.

Note: Having the agent installed on the hosts is not required, but is recommended. Metadata autocomplete on the filters and searches depend on the Sysdig agent.

Enable Host Scanning

Installation methods include Helm (recommended), Docker container, or non-containerized binaries.

Supported OSes and Host Types

• Ubuntu 22.04
• Ubuntu 20.04
• Debian 11
• Debian 10
• Redhat Red Hat Enterprise Linux 9
• Redhat Red Hat Enterprise Linux 8
• Redhat Red Hat Enterprise Linux 7
• Red Hat Red Hat Enterprise Linux Core OS
• Amazon Linux 2
• Flatcar Container Linux
• Alibaba Cloud Linux (a.k.a. Aliyun Linux)
• Google Container-Optimized OS (COS), build 89+

Currently Supported CPU Architectures

• AMD64 (x86_64)

• ARM (arm64)

Current Feature Limitations

• No Risk Spotlight/In Use integration

How Long until Host Scan Results Appear in the UI?

After installation:

• If the default parameter nodeAnalyzer.nodeAnalyzer.hostScanner.scanOnStart=true is set, then a scan will start just after the pod is ready. You can expect the results in a few minutes, ~15 min max.
• If this parameter is not set, results will be shown ~11 hours from install
• In all cases, scans are refreshed every 12 hours
• Helm chart and Docker container installations behave the same

Helm Install

If you have Kubernetes, the Helm install is the preferred method.

Prerequisites

Host scanning requires Sysdig Secure SaaS to be installed with:

• sysdig-deploy Helm chart version 1.5.0+
  • HostScanner container version 0.3.0+ (*0.3.1+ for Google COS)
  • Included by default on the helm chart version 1.5.0+, unless the user pins or modifies the defaults

• Host scanning is installed out of the box by default with the Helm chart; you can opt-out if desired.

Check Your Versions

Check your sysdig-deploy Helm chart (default namespace is sysdig-agent)

helm list -n <namespace>

Example:

$ helm list -n sysdig-agent
NAME            NAMESPACE       REVISION        UPDATED                                 STATUS          CHART                   APP VERSION
sysdig-agent    sysdig-agent    5               2022-11-11 17:57:54.109917081 +0100 CET deployed        sysdig-deploy-1.5.0

Upgrade Helm Chart Instructions here

Opting Out

If for some reason you don’t want to use host scanning, you can opt-out using the Helm chart flag:

--set nodeAnalyzer.nodeAnalyzer.hostScanner.deploy=false

Docker Container Install

If you have non-Kubernetes hosts but still want to use containers, you can deploy Host scanning without Helm as follows:

docker run --detach -e HOST_FS_MOUNT_PATH=/host -e SYSDIG_ACCESS_KEY=<access-key> -e SYSDIG_API_URL=<sysdig-secure-endpoint> -e SCAN_ON_START=true -v /:/host:ro --uts=host --net=host quay.io/sysdig/vuln-host-scanner:$(curl -L -s https://download.sysdig.com/scanning/sysdig-host-scanner/latest_version.txt)

• Retrieve your access key
• Check your Sysdig Secure endpoint by region

Non-Containerized Install

The Helm chart is the recommended installation method, but if you want to scan a host without using containers at all, we also offer a standalone binary and an RPM package.

The configuration is passed via environment variables, specifically:

• Retrieve your access key to use for SYSDIG_ACCESS_KEY=<your-access-key>
• Check your Sysdig Secure endpoint by region to use for SYSDIG_API_URL=https://<sysdig-url>

RPM

Compatible with any host that supports the RPM package format, such as RHEL.

# Configure the repo
$ rpm --import https://download.sysdig.com/DRAIOS-GPG-KEY.public
$ curl -s -o /etc/yum.repos.d/draios.repo http://download.sysdig.com/stable/rpm/draios.repo

# Update index
$ yum update

# Install the package
$ yum install vuln-host-scanner

# Create your configuration file
$ cat /opt/draios/etc/vuln-host-scanner/env
SYSDIG_ACCESS_KEY=<access-key>
SYSDIG_API_URL=<api-url>
SCAN_ON_START=true # optional

# Enable the service
$ systemctl enable vuln-host-scanner.service

# Start the service
$ systemctl start vuln-host-scanner.service

# Check logs
$ journalctl -u vuln-host-scanner.service

Raw Binary

## Binary

$ ARCH=amd64; curl -s https://download.sysdig.com/scanning/bin/sysdig-host-scanner/$(curl -L -s https://download.sysdig.com/scanning/sysdig-host-scanner/latest_version.txt)/linux/$ARCH/sysdig-host-scanner > sysdig-host-scanner
# ARCH=arm64 for arm architectures

# Give exec permission
$ chmod +x sysdig-host-scanner

# Run it 
$ SYSDIG_ACCESS_KEY=<access-key> SYSDIG_API_URL=<api-url> ./sysdig-host-scanner

Kubernetes Metadata:

If your node is part of an existing Kubernetes installation and you’re not using the official Helm chart, you’ll be in charge of setting node name and cluster name via

K8S_CLUSTER_NAME
K8S_NODE_NAME

Other environment variables for the Host Scanner are listed in the chart.

Usage

Once you have deployed the host scanner in your environment, the Runtime UI will integrate the findings alongside the runtime workload results, based on an out-of-the-box Vulnerability policy.

Filter for Hosts

You can filter to find results of host scanning using the quick links in the banner at the top of the page, and/or the filter bar.

Hosts can be filtered using

• Kubernetes cluster name
• Cloud account id
• Cloud account region
• Host Name
• Agent tags

See also, Vulnerability Policies|Runtime.

Download Reports

You can schedule and download reports for scanning done on hosts as well as containers.

See Vulnerabilities|Reporting.