This repository was archived by the owner on Dec 23, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathstix-tetragon-observable.json
67 lines (67 loc) · 2.48 KB
/
stix-tetragon-observable.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
{
"type": "bundle",
"id": "bundle--3b3d4e1b-4e4d-4e7c-834d-437eab41a5d3",
"spec_version": "2.1",
"objects": [
{
"type": "process",
"id": "process--5b4f20e7-76fd-4bc8-bd23-4b9c4b15a17e",
"pid": 13312,
"command_line": "/var/lib/rancher/rke2/data/v1.28.8-rke2r1-c4073db9beee/bin/containerd-shim-runc-v2 -namespace k8s.io -id e398dd9deb6d850fcc9327f16b3b1204135ed4ea6a27750160d340ca467fa087 -address /run/k3s/containerd/containerd.sock",
"cwd": "/run/k3s/containerd/io.containerd.runtime.v2.task/k8s.io/e398dd9deb6d850fcc9327f16b3b1204135ed4ea6a27750160d340ca467fa087",
"created_time": "2024-03-30T18:13:47.987328Z",
"image_ref": "file--3c4b7b8c-2e6e-4c8b-bc5e-7c2e4b5a2d8e",
"extensions": {
"flags": "procFS auid",
"parent_exec_id": "azhzLWFnZW50LTAwMjo2MDAwMDAwMDox"
}
},
{
"type": "process",
"id": "process--8afdc739-2c3b-4c7e-8890-7742c0c8f8cd",
"pid": 14287,
"command_line": "/usr/bin/tail -F /var/log/auditlog/rancher-api-audit.log",
"cwd": "/",
"created_time": "2024-03-30T18:14:23.507328Z",
"image_ref": "file--3c4b7b8c-2e6e-4c8b-bc5e-7c2e4b5a2d3l",
"parent_ref": "process--5b4f20e7-76fd-4bc8-bd23-4b9c4b15a17e",
"extensions": {
"flags": "procFS auid rootcwd",
"docker": "4b7371b1104abe7634abc1c6f00d04a",
"container_id": "containerd://4b7371b1104abe7634abc1c6f00d04a9ab79145d6093bec2783933a206afc632",
"pod_name": "rancher-55966c8d68-f56sc",
"namespace": "cattle-system"
}
},
{
"type": "file",
"id": "file--3c4b7b8c-2e6e-4c8b-bc5e-7c2e4b5a2d8e",
"name": "containerd-shim-runc-v2"
},
{
"type": "file",
"id": "file--3c4b7b8c-2e6e-4c8b-bc5e-7c2e4b5a2d3l",
"name": "/usr/bin/tail"
},
{
"type": "observed-data",
"id": "observed-data--5f2d4e5b-3d4e-4e7c-834d-437eab41a5d3",
"created": "2024-03-30T18:14:23.507328Z",
"modified": "2024-03-30T18:14:23.507328Z",
"first_observed": "2024-03-30T18:14:23.507328Z",
"last_observed": "2024-03-30T18:14:23.507328Z",
"number_observed": 1,
"object_refs": [
"process--8afdc739-2c3b-4c7e-8890-7742c0c8f8cd",
"process--5b4f20e7-76fd-4bc8-bd23-4b9c4b15a17e",
"file--3c4b7b8c-2e6e-4c8b-bc5e-7c2e4b5a2d8e",
"file--3c4b7b8c-2e6e-4c8b-bc5e-7c2e4b5a2d3l"
],
"extensions": {
"node_info": {
"node_name": "k8s-agent-002"
}
}
}
]
}