The security-events-manager module: custom resources

ClusterSecurityEventAlertRule

Short names: csear

Scope: Cluster
Version: v1alpha1

• spec

  object

  Turns a pattern in security events into a Prometheus alert.

  A rule looks for a pattern in the collected security events, for example “one actor read more than 20 secrets in 5 minutes”, and raises a named alert once the pattern occurs. The pattern is expressed as a LogQL query and evaluated against the cluster Loki, so the cluster-loki destination must be enabled for any rule to work.

  Rules are organized into groups. A group has no effect on evaluation: each rule is evaluated on its own, independently of the other rules in its group.

  A firing rule raises the D8SecurityEventAlertFiring alert, which reaches the operator the same way as any other cluster alert: as a ClusterAlert object, in the console, and through the cluster alert delivery. Delivery requires no configuration.

  The structure mirrors PrometheusRule: named groups, each with an interval and a list of rules carrying alert, expr, for, labels and annotations. The difference is that expr is written in LogQL rather than in PromQL.

  • spec.groups

    array of objects

    Required value

    List of rule groups.

    A group consists of a name and a list of rules. It does not affect how or when its rules are evaluated and only keeps related rules together. The same structure as spec.groups of PrometheusRule.

    • spec.groups.interval

      string

      How often every rule in this group is evaluated against Loki.

      Digits followed by s, m or h, for example 30s. The default is 30s.

      Default: 30s

      Pattern: ^[0-9]+(s|m|h)$

    • spec.groups.name

      string

      Group name.

      Does not affect evaluation and is used only in the output of d8 k get -o yaml and in logs, to identify the group.

      Length: 1..253

    • spec.groups.rules

      array of objects

      Alert rules in this group.
      • spec.groups.rules.aggregation

        object

        Counting parameters of the rule.

        Events are grouped by groupBy, and the alert fires as soon as a group reaches threshold within window. The window slides continuously: it is recomputed against the logs stored in Loki on every evaluation rather than kept as counter state.

        Requires match, because a rule based on expr expresses grouping and the threshold in the query itself. Without aggregation, a rule based on match fires on every matched event.

        • spec.groups.rules.aggregation.groupBy

          array of strings

          Required value

          Event fields that identify a group.

          Values of these fields become alert labels, so the set of allowed fields is limited to attributes with low cardinality. Using an object name as a key, for example, would create a separate group per event, cause unbounded growth of the evaluator and overload the alert receiver.

          • spec.groups.rules.aggregation.groupBy.Element of the array

            string

            Event field to group by.

            Each value is named after the field it reads in LogQL:

            • EventCode reads event_code;
            • EventSeverity reads event_severity;
            • EventCategory reads event_category;
            • SourceComponent reads source_component;
            • ActorID reads actor_id;
            • ActorSourceIP reads actor_sourceIP;
            • ObjectNamespace reads object_namespace;
            • ObjectType reads object_type.

            Allowed values: EventCode, EventSeverity, EventCategory, SourceComponent, ActorID, ActorSourceIP, ObjectNamespace, ObjectType

        • spec.groups.rules.aggregation.threshold

          integer

          Required value

          Number of events in a group that triggers the alert.

          To raise an alert on every event, use a rule without the aggregation block.

          Allowed values: 2 <= X

        • spec.groups.rules.aggregation.window

          string

          Required value

          Time span over which a group keeps counting before it is forgotten.

          Digits followed by s, m or h, for example 5m. Choose the span within which the described behaviour occurs: minutes for a brute-force attempt, hours for a slow sweep.

          Pattern: ^[0-9]+(s|m|h)$

      • spec.groups.rules.alert

        string

        Short name of what the rule detects, for example MassSecretAccess.

        The name identifies the rule in the alert label of the produced metric, in logs and in the status of the rule itself. The equivalent of the alert field of PrometheusRule.

        Maximum length: 253

        Pattern: ^[A-Za-z][A-Za-z0-9_]*$

      • spec.groups.rules.annotations

        object

        Text shown alongside the alert once it fires.

        Unlike labels, annotations do not identify the alert and are intended to be read by a human. The field is required: every rule must state in summary what it detected, and that text is what the fired alert carries.

        A value may quote the data that made the rule fire, the same way Prometheus templates the annotations of PrometheusRule. Use {{ $labels.<NAME> }} for one of the labels that expr grouped by and {{ $value }} for the number that expr produced, for example {{ $labels.actor_id }} read secrets {{ $value }} times.

        The rendered text is passed as a label of the firing metric, so each distinct rendering becomes a separate Prometheus series for the whole retention period. In a rule whose count changes on every evaluation, {{ $value }} therefore adds a series per interval. Prefer {{ $labels.<NAME> }}, which stays stable for as long as the group exists.

        • spec.groups.rules.annotations.description

          string

          Detailed description, shown in the description annotation of the alert.

          State what to check and where, the way a runbook does.

          Maximum length: 4096

        • spec.groups.rules.annotations.summary

          string

          Required value

          Short one-line summary, shown in the summary annotation of the alert, for example One actor read an unusual number of secrets.

          Maximum length: 512

      • spec.groups.rules.expr

        string

        LogQL query that determines whether the rule fires.

        Each rule sets exactly one of expr and match. Use expr when the structured fields of match cannot express the required condition.

        The query must be a metric query, that is, one that returns a number rather than a list of log lines, and must include the comparison itself. For example:

        sum by (actor_id) (
          count_over_time({source_component="kube-audit",
                           event_code="K8S_SECRET_ACCESSED",
                           actor_id!=""} [5m])
        ) > 20

        The query above consists of the following parts:

        • {source_component="kube-audit", ...} selects the log streams to search;
        • count_over_time(...[5m]) counts the matching lines over the last 5 minutes;
        • sum by (actor_id) keeps a separate count per actor instead of summing the events of all actors;
        • > 20 is the condition itself: the rule fires once the count for any actor exceeds 20.

        No further processing of the number is required: reaching the threshold set in the query is what firing means.

        Every field listed in sum by (...) or a similar aggregation becomes a label of the resulting alert. Keep that list short and limited to fields with a bounded set of values, as described in the section on the specifics of writing rules on the examples page.

        The equivalent of the expr field of PrometheusRule, written in LogQL rather than in PromQL.

        Length: 1..8192

      • spec.groups.rules.for

        string

        Time span over which expr must keep matching without a break before the rule fires.

        The field filters out one-off spikes: with for: 5m, a spike that lasts a couple of minutes and then stops does not fire the rule at all.

        Digits followed by s, m or h, for example 5m. The default is 0s, meaning that the rule fires on the first match of expr, with no waiting period.

        The pending and firing semantics are the same as for the for field of PrometheusRule.

        Default: 0s

        Pattern: ^[0-9]+(s|m|h)$

      • spec.groups.rules.labels

        object

        Additional alert labels.

        They are added next to rule, alert, severity_level and the fields that expr groups by. Labels identify the alert: two alerts with the same labels are the same alert.

      • spec.groups.rules.match

        object

        Security events the rule applies to.

        Criteria are combined with AND.

        Each rule sets exactly one of expr and match. The match and aggregation fields are compiled into the same kind of LogQL query that expr would hold, so they are a form for building that query rather than a separate evaluation path. Use expr directly when a rule requires a field that this form does not cover or a line filter more specific than an exact or glob match.

        • spec.groups.rules.match.actorType

          string

          Kind of subject the rule is narrowed to.

          ServiceAccounts keeps only the actors matching system:serviceaccount:*. NonServiceAccounts keeps all the others and is used for rules about people and other external clients. Mirrors the “Subject type” filter of the console.

          Default: Any

          Allowed values: Any, ServiceAccounts, NonServiceAccounts

        • spec.groups.rules.match.actors

          array of strings

          Actors whose events are counted.

          Values are matched against actor_id the same way as in excludeActors: * stands for any sequence of characters, everything else is literal.

          Use this field to watch a specific subject, for example a ServiceAccount that must not change secrets.

        • spec.groups.rules.match.categories

          array of strings

          Event categories to match, as declared in spec.category of SecurityEventDefinition.
          • spec.groups.rules.match.categories.Element of the array

            string

            Allowed values: Auth, Config, Network, Rbac, Runtime

        • spec.groups.rules.match.eventCodes

          array of strings

          Event codes to match, as declared in SecurityEventDefinition.
          • spec.groups.rules.match.eventCodes.Element of the array

            string

            For example K8S_SECRET_ACCESSED.

            Pattern: ^[A-Z][A-Z0-9_]*$

        • spec.groups.rules.match.excludeActors

          array of strings

          Actors whose events the rule ignores.

          Values are matched against actor_id: * stands for any sequence of characters, everything else is literal.

          Platform components generate most of the routine activity. On an idle cluster, the Deckhouse ServiceAccount alone accounts for thousands of secret reads per hour, so a rule about people and workloads has to exclude them. A typical list:

          excludeActors:
            - "system:serviceaccount:d8-*"
            - "system:serviceaccount:kube-system:*"
            - "system:node:*"
            - "system:apiserver"

        • spec.groups.rules.match.excludeSystemActors

          boolean

          Whether to ignore the events produced by the platform itself.

          Routine cluster work touches secrets, RBAC and pods constantly. On an idle cluster, the Deckhouse ServiceAccount alone accounted for 2617 of 2812 secret reads in an hour, which makes a rule about people and workloads statistically insignificant against that background.

          The list is maintained by the module and matches the “Exclude system” filter of the console, so the interface and the rule put the same events out of view. The list covers actor_id matching system:serviceaccount:kube-system:*, system:serviceaccount:d8-*, system:node:*, system:kube-*, system:apiserver and kubernetes-admin.

          Nothing is removed from the event stream: the events are still collected and delivered, and only stop being counted. Events without an actor are kept, and anonymous or unauthenticated identities are never treated as platform actors, because those are what a security rule looks for.

          Default: true

        • spec.groups.rules.match.severityMin

          string

          Minimal event severity to match (inclusive).

          Allowed values: Low, Medium, High, Critical

        • spec.groups.rules.match.sources

          array of strings

          Source components to match, as declared in spec.source of SecurityEventDefinition, for example kube-audit.
      • spec.groups.rules.mode

        string

        Which of the two ways this rule is written in.

        Expr — the condition is a LogQL query written by hand in expr. Match — the condition is built from the structured fields of match, optionally counted by aggregation.

        The field states explicitly what the presence of expr or match already implies, and must agree with it. It exists so that a reader of the manifest and the platform web interface both know which form a rule is written in without inspecting which block is filled: the web interface shows the fields of the selected mode only, and hides the other form entirely.

        Allowed values: Expr, Match

      • spec.groups.rules.severityLevel

        integer

        DKP severity level, sent as the severity_level label.

        On clusters with update.blockOnAlerts enabled in the deckhouse module, an alert with a level at or below the configured threshold (4 by default) blocks DKP releases from being applied.

        Default: 6

        Allowed values: 0 <= X <= 9

• status

  object

  Current status of this resource.
  • status.conditions

    array of objects

    Represents the latest available observations of an object’s state.
    • status.conditions.lastTransitionTime

      string
    • status.conditions.message

      string

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer
    • status.conditions.reason

      string

      Length: 1..1024

    • status.conditions.status

      string

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Maximum length: 316

  • status.observedGeneration

    integer

    The generation observed by the controller.

ClusterSecurityEventConfig

Short names: csec

Scope: Cluster
Version: v1alpha1

• spec

  object

  Defines which sources are enabled and which destinations they are shipped to.
  • spec.cef

    object

    Default CEF (Common Event Format) metadata for destinations that use CEF encoding.

    These values are used when a ClusterSecurityEventDestination has encoding.codec set to CEF but does not specify its own cef.deviceVendor, cef.deviceProduct and cef.deviceVersion.

    • spec.cef.deviceProduct

      string

      Default device product for CEF header.

      Default: security-events-manager

    • spec.cef.deviceVendor

      string

      Default device vendor for CEF header.

      Default: Deckhouse

    • spec.cef.deviceVersion

      string

      Default device version for CEF header.

      Default: 1

  • spec.defaultSeverityThreshold

    string

    Required value

    Minimal severity to ship (inclusive).

    Allowed values: Low, Medium, High, Critical

  • spec.destinations

    array of strings

    Required value

    List of ClusterSecurityEventDestination names.
  • spec.enabledSources

    array of strings

    Sources that are enabled.

    If the parameter is omitted, all sources are enabled. Each item uses one of the following formats:

    • clusterSecurityEventShipper/<SHIPPER NAME>/<SOURCE>;
    • podSecurityEventShipper/<NAMESPACE>/<SHIPPER NAME>/<SOURCE>.
    • spec.enabledSources.Element of the array

      string

      Pattern: ^(clusterSecurityEventShipper/[^/]+/[^/]+|podSecurityEventShipper/[^/]+/[^/]+/[^/]+)$

  • spec.enabledSourcesMasks

    array of strings

    Glob masks of the sources that are enabled.

    If the parameter is omitted, all sources are enabled. A * in a mask matches any substring, including /. The parameters enabledSources and enabledSourcesMasks are mutually exclusive.

    Each mask uses one of the following formats:

    • clusterSecurityEventShipper/<SHIPPER NAME>/<SOURCE>;
    • podSecurityEventShipper/<NAMESPACE>/<SHIPPER NAME>/<SOURCE>.

    For example:

    enabledSourcesMasks:
      - podSecurityEventShipper/*
      - clusterSecurityEventShipper/kube-audit/*

    • spec.enabledSourcesMasks.Element of the array

      string

      Pattern: ^(clusterSecurityEventShipper/.+|podSecurityEventShipper/.+)$

• status

  object

  Current status of this resource.
  • status.conditions

    array of objects

    Represents the latest available observations of an object’s state.
    • status.conditions.lastTransitionTime

      string
    • status.conditions.message

      string

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer
    • status.conditions.reason

      string

      Length: 1..1024

    • status.conditions.status

      string

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Maximum length: 316

  • status.observedGeneration

    integer

    The generation observed by the controller.

ClusterSecurityEventDestination

Short names: csed

Scope: Cluster
Version: v1alpha1

• spec

  object

  Describes where to send security events.

  Fields are designed to be translated to deckhouse.io/log-shipper ClusterLogDestination.

  • spec.buffer

    object

    Per-destination buffer settings for the gateway Vector sink.

    Overrides the global gateway.buffer defaults from module values. If not set, the global defaults are used.

    • spec.buffer.maxEvents

      integer

      Maximum number of events in the buffer.

      Used as a secondary limit for Memory type. Ignored when type=Disk (disk buffer uses maxSize only).

      Default: 500

      Allowed values: 100 <= X

    • spec.buffer.maxSize

      string

      Maximum size of the buffer as a Kubernetes quantity string with a mandatory unit suffix for example 512Mi, 1Gi or 256Mi.

      Plain numbers without a unit suffix are not accepted. For Disk: maximum disk space used on the volume. For Memory: approximate memory limit for the in-memory ring buffer.

      Default: 512Mi

      Pattern: ^[0-9]+(\.[0-9]+)?(Ki|Mi|Gi|Ti|Pi|Ei|k|M|G|T|P|E)$

    • spec.buffer.type

      string

      Buffer type.

      Possible values:

      • Disk: disk-based buffer using LevelDB. Survives Vector process restarts within the pod. Used by default and ensures that no security events are lost during a temporary destination outage.
      • Memory: in-memory ring buffer. Faster, but all events are lost on Vector process restart. Use only for test/dev environments.

      Default: Disk

      Allowed values: Memory, Disk

    • spec.buffer.whenFull

      string

      Behavior when the buffer is full.

      Possible values:

      • Block: apply backpressure to upstream. The pipeline slows down, but no events are lost. Used by default and is the correct choice for security events.
      • DropNewest: discard incoming events. Data loss occurs but no backpressure. Use only when data loss is acceptable (test environments).

      Default: Block

      Allowed values: Block, DropNewest

  • spec.console

    object
    • spec.console.encoding

      object

      Encoding format for events sent to console.

      Default is JSON. Set codec to CEF to emit events in Common Event Format.

      • spec.console.encoding.cef

        object

        CEF-specific configuration fields.

        Only applicable when codec is set to CEF. If omitted, defaults are used: deviceVendor=Deckhouse, deviceProduct=security-events-manager, version=1.

        • spec.console.encoding.cef.deviceProduct

          string

          Device product field in the CEF header.

          Default: security-events-manager

        • spec.console.encoding.cef.deviceVendor

          string

          Device vendor field in the CEF header.

          Default: Deckhouse

        • spec.console.encoding.cef.deviceVersion

          string

          Device version field in the CEF header.

          Default: 1

      • spec.console.encoding.codec

        string

        Encoding codec for the destination.

        Possible values:

        • JSON — structured JSON, used by default and suitable for Loki, Elasticsearch and Kafka;
        • CEF — Common Event Format, suitable for SIEM integration through Kafka, Vector, File and Console.

        Default: JSON

        Allowed values: JSON, CEF

      • spec.console.encoding.syslogWrapper

        string

        Syslog header wrapping for CEF output.

        Only applicable when codec is CEF.

        Possible values:

        • None — emit a bare CEF string, used by default;
        • RFC3164 — prepend an RFC 3164 (BSD syslog) header;
        • RFC5424 — prepend an RFC 5424 (IETF syslog) header.

        Default: None

        Allowed values: None, RFC3164, RFC5424

    • spec.console.target

      string

      Default: Stdout

      Allowed values: Stdout, Stderr

  • spec.elasticsearch

    object
    • spec.elasticsearch.auth

      object
      • spec.elasticsearch.auth.password

        string

        Password for Basic authentication.

        Consider using passwordSecretRef instead to avoid storing secrets in the resource spec.

      • spec.elasticsearch.auth.passwordSecretRef

        object
        • spec.elasticsearch.auth.passwordSecretRef.name

          string

          Required value

          Name of the secret in the d8-security-events-manager namespace containing the credential.

          The secret must have the key value in its data field.

      • spec.elasticsearch.auth.strategy

        string

        Default: None

        Allowed values: None, Bearer, Basic

      • spec.elasticsearch.auth.token

        string

        Bearer token for authentication.

        Consider using tokenSecretRef instead to avoid storing secrets in the resource spec.

      • spec.elasticsearch.auth.tokenSecretRef

        object
        • spec.elasticsearch.auth.tokenSecretRef.name

          string

          Required value

          Name of the secret in the d8-security-events-manager namespace containing the credential.

          The secret must have the key value in its data field.

      • spec.elasticsearch.auth.username

        string
    • spec.elasticsearch.endpoint

      string

      Required value
    • spec.elasticsearch.index

      string
    • spec.elasticsearch.tls

      object
      • spec.elasticsearch.tls.ca

        string

        Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      • spec.elasticsearch.tls.verifyCertificate

        boolean

        Default: true

      • spec.elasticsearch.tls.verifyHostname

        boolean

        Default: true

  • spec.file

    object
    • spec.file.encoding

      object

      Encoding format for events written to this file destination.

      Default is JSON. Set codec to CEF to write events in Common Event Format.

      • spec.file.encoding.cef

        object

        CEF-specific configuration fields.

        Only applicable when codec is set to CEF. If omitted, defaults are used: deviceVendor=Deckhouse, deviceProduct=security-events-manager, version=1.

        • spec.file.encoding.cef.deviceProduct

          string

          Device product field in the CEF header.

          Default: security-events-manager

        • spec.file.encoding.cef.deviceVendor

          string

          Device vendor field in the CEF header.

          Default: Deckhouse

        • spec.file.encoding.cef.deviceVersion

          string

          Device version field in the CEF header.

          Default: 1

      • spec.file.encoding.codec

        string

        Encoding codec for the destination.

        Possible values:

        • JSON — structured JSON, used by default and suitable for Loki, Elasticsearch and Kafka;
        • CEF — Common Event Format, suitable for SIEM integration through Kafka, Vector, File and Console.

        Default: JSON

        Allowed values: JSON, CEF

      • spec.file.encoding.syslogWrapper

        string

        Syslog header wrapping for CEF output.

        Only applicable when codec is CEF.

        Possible values:

        • None — emit a bare CEF string, used by default;
        • RFC3164 — prepend an RFC 3164 (BSD syslog) header;
        • RFC5424 — prepend an RFC 5424 (IETF syslog) header.

        Default: None

        Allowed values: None, RFC3164, RFC5424

    • spec.file.path

      string

      Required value
  • spec.http

    object
    • spec.http.auth

      object
      • spec.http.auth.password

        string

        Password for Basic authentication.

        Consider using passwordSecretRef instead to avoid storing secrets in the resource spec.

      • spec.http.auth.passwordSecretRef

        object
        • spec.http.auth.passwordSecretRef.name

          string

          Required value

          Name of the secret in the d8-security-events-manager namespace containing the credential.

          The secret must have the key value in its data field.

      • spec.http.auth.strategy

        string

        Default: None

        Allowed values: None, Bearer, Basic

      • spec.http.auth.token

        string

        Bearer token for authentication.

        Consider using tokenSecretRef instead to avoid storing secrets in the resource spec.

      • spec.http.auth.tokenSecretRef

        object
        • spec.http.auth.tokenSecretRef.name

          string

          Required value

          Name of the secret in the d8-security-events-manager namespace containing the credential.

          The secret must have the key value in its data field.

      • spec.http.auth.username

        string
    • spec.http.endpoint

      string

      Required value

      Full URL to send events to, including the path, for example https://collector.example.com/api/ingest.

      Events are always sent with the POST method.

    • spec.http.framing

      string

      How a set of events is laid out in the request body.

      JSONArray wraps the set into a single JSON array, which is what receivers expecting one document per request read. NewlineDelimited sends one JSON object per line (NDJSON), which suits collectors that read a stream of records.

      Default: JSONArray

      Allowed values: JSONArray, NewlineDelimited

    • spec.http.headers

      object

      Additional request headers.

      The Authorization header is managed by auth and must not be set here.

    • spec.http.tls

      object
      • spec.http.tls.ca

        string

        Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      • spec.http.tls.verifyCertificate

        boolean

        Default: true

      • spec.http.tls.verifyHostname

        boolean

        Default: true

  • spec.kafka

    object
    • spec.kafka.brokers

      array of strings

      Required value
    • spec.kafka.encoding

      object

      Encoding format for events sent to this Kafka destination.

      Default is JSON. Set codec to CEF to emit events in Common Event Format (requires a CEF-capable SIEM consumer on the receiving end).

      • spec.kafka.encoding.cef

        object

        CEF-specific configuration fields.

        Only applicable when codec is set to CEF. If omitted, defaults are used: deviceVendor=Deckhouse, deviceProduct=security-events-manager, version=1.

        • spec.kafka.encoding.cef.deviceProduct

          string

          Device product field in the CEF header.

          Default: security-events-manager

        • spec.kafka.encoding.cef.deviceVendor

          string

          Device vendor field in the CEF header.

          Default: Deckhouse

        • spec.kafka.encoding.cef.deviceVersion

          string

          Device version field in the CEF header.

          Default: 1

      • spec.kafka.encoding.codec

        string

        Encoding codec for the destination.

        Possible values:

        • JSON — structured JSON, used by default and suitable for Loki, Elasticsearch and Kafka;
        • CEF — Common Event Format, suitable for SIEM integration through Kafka, Vector, File and Console.

        Default: JSON

        Allowed values: JSON, CEF

      • spec.kafka.encoding.syslogWrapper

        string

        Syslog header wrapping for CEF output.

        Only applicable when codec is CEF.

        Possible values:

        • None — emit a bare CEF string, used by default;
        • RFC3164 — prepend an RFC 3164 (BSD syslog) header;
        • RFC5424 — prepend an RFC 5424 (IETF syslog) header.

        Default: None

        Allowed values: None, RFC3164, RFC5424

    • spec.kafka.sasl

      object
      • spec.kafka.sasl.mechanism

        string

        Allowed values: Plain, SCRAM-SHA-256, SCRAM-SHA-512

      • spec.kafka.sasl.password

        string

        SASL password.

        Consider using passwordSecretRef instead to avoid storing secrets in the resource spec.

      • spec.kafka.sasl.passwordSecretRef

        object
        • spec.kafka.sasl.passwordSecretRef.name

          string

          Required value

          Name of the secret in the d8-security-events-manager namespace containing the credential.

          The secret must have the key value in its data field.

      • spec.kafka.sasl.username

        string
    • spec.kafka.tls

      object
      • spec.kafka.tls.ca

        string

        Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      • spec.kafka.tls.verifyCertificate

        boolean

        Default: true

      • spec.kafka.tls.verifyHostname

        boolean

        Default: true

    • spec.kafka.topic

      string

      Required value
  • spec.loki

    object
    • spec.loki.auth

      object
      • spec.loki.auth.password

        string

        Password for Basic authentication.

        Consider using passwordSecretRef instead to avoid storing secrets in the resource spec.

      • spec.loki.auth.passwordSecretRef

        object
        • spec.loki.auth.passwordSecretRef.name

          string

          Required value

          Name of the secret in the d8-security-events-manager namespace containing the credential.

          The secret must have the key value in its data field.

      • spec.loki.auth.strategy

        string

        Default: None

        Allowed values: None, Bearer, Basic

      • spec.loki.auth.token

        string

        Bearer token for authentication.

        Consider using tokenSecretRef instead to avoid storing secrets in the resource spec.

      • spec.loki.auth.tokenSecretRef

        object
        • spec.loki.auth.tokenSecretRef.name

          string

          Required value

          Name of the secret in the d8-security-events-manager namespace containing the credential.

          The secret must have the key value in its data field.

      • spec.loki.auth.username

        string
    • spec.loki.endpoint

      string

      Required value
    • spec.loki.tls

      object
      • spec.loki.tls.ca

        string

        Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      • spec.loki.tls.verifyCertificate

        boolean

        Default: true

      • spec.loki.tls.verifyHostname

        boolean

        Default: true

  • spec.socket

    object
    • spec.socket.address

      string

      Required value

      The address to connect to.

      Format depends on mode:

      • TCP — host:port, for example siem.example.com:514;
      • UDP — host:port, for example siem.example.com:514;
      • Unix — /path/to/socket, for example /var/run/siem.sock.
    • spec.socket.encoding

      object

      Encoding format for events sent to this socket destination.

      Default is JSON. Set codec to CEF to emit events in Common Event Format (the primary use-case for syslog-based SIEM integrations).

      • spec.socket.encoding.cef

        object

        CEF-specific configuration fields.

        Only applicable when codec is set to CEF. If omitted, defaults are used: deviceVendor=Deckhouse, deviceProduct=security-events-manager, version=1.

        • spec.socket.encoding.cef.deviceProduct

          string

          Device product field in the CEF header.

          Default: security-events-manager

        • spec.socket.encoding.cef.deviceVendor

          string

          Device vendor field in the CEF header.

          Default: Deckhouse

        • spec.socket.encoding.cef.deviceVersion

          string

          Device version field in the CEF header.

          Default: 1

      • spec.socket.encoding.codec

        string

        Encoding codec for the destination.

        Possible values:

        • JSON — structured JSON, used by default and suitable for Loki, Elasticsearch and Kafka;
        • CEF — Common Event Format, suitable for SIEM integration through Kafka, Vector, File and Console.

        Default: JSON

        Allowed values: JSON, CEF

      • spec.socket.encoding.syslogWrapper

        string

        Syslog header wrapping for CEF output.

        Only applicable when codec is CEF.

        Possible values:

        • None — emit a bare CEF string, used by default;
        • RFC3164 — prepend an RFC 3164 (BSD syslog) header;
        • RFC5424 — prepend an RFC 5424 (IETF syslog) header.

        Default: None

        Allowed values: None, RFC3164, RFC5424

    • spec.socket.mode

      string

      Required value

      Socket transport mode.

      Possible values:

      • TCP — stream-oriented and reliable, supports TLS. Recommended for a production syslog;
      • UDP — datagram-oriented, with no delivery guarantee. The maximum message size is limited by the MTU;
      • Unix — local Unix domain socket in stream mode. Intended for SIEM agents running as a sidecar.

      Allowed values: TCP, UDP, Unix

    • spec.socket.tls

      object

      TLS configuration.

      Only applicable when mode is TCP. Ignored for UDP and Unix modes.

      • spec.socket.tls.ca

        string

        Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      • spec.socket.tls.verifyCertificate

        boolean

        Default: true

      • spec.socket.tls.verifyHostname

        boolean

        Default: true

  • spec.splunkHEC

    object
    • spec.splunkHEC.endpoint

      string

      Required value
    • spec.splunkHEC.tls

      object
      • spec.splunkHEC.tls.ca

        string

        Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      • spec.splunkHEC.tls.verifyCertificate

        boolean

        Default: true

      • spec.splunkHEC.tls.verifyHostname

        boolean

        Default: true

    • spec.splunkHEC.token

      string

      Splunk HEC token.

      Consider using tokenSecretRef instead to avoid storing secrets in the resource spec.

    • spec.splunkHEC.tokenSecretRef

      object
      • spec.splunkHEC.tokenSecretRef.name

        string

        Required value

        Name of the secret in the d8-security-events-manager namespace containing the credential.

        The secret must have the key value in its data field.

  • spec.type

    string

    Required value

    Allowed values: Loki, Elasticsearch, Kafka, SplunkHEC, File, Console, Vector, Socket, Http

  • spec.vector

    object
    • spec.vector.encoding

      object

      Encoding format for events sent to this Vector destination.

      Default is JSON. Set codec to CEF to emit events in Common Event Format.

      • spec.vector.encoding.cef

        object

        CEF-specific configuration fields.

        Only applicable when codec is set to CEF. If omitted, defaults are used: deviceVendor=Deckhouse, deviceProduct=security-events-manager, version=1.

        • spec.vector.encoding.cef.deviceProduct

          string

          Device product field in the CEF header.

          Default: security-events-manager

        • spec.vector.encoding.cef.deviceVendor

          string

          Device vendor field in the CEF header.

          Default: Deckhouse

        • spec.vector.encoding.cef.deviceVersion

          string

          Device version field in the CEF header.

          Default: 1

      • spec.vector.encoding.codec

        string

        Encoding codec for the destination.

        Possible values:

        • JSON — structured JSON, used by default and suitable for Loki, Elasticsearch and Kafka;
        • CEF — Common Event Format, suitable for SIEM integration through Kafka, Vector, File and Console.

        Default: JSON

        Allowed values: JSON, CEF

      • spec.vector.encoding.syslogWrapper

        string

        Syslog header wrapping for CEF output.

        Only applicable when codec is CEF.

        Possible values:

        • None — emit a bare CEF string, used by default;
        • RFC3164 — prepend an RFC 3164 (BSD syslog) header;
        • RFC5424 — prepend an RFC 5424 (IETF syslog) header.

        Default: None

        Allowed values: None, RFC3164, RFC5424

    • spec.vector.endpoint

      string

      Required value
    • spec.vector.tls

      object
      • spec.vector.tls.ca

        string

        Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      • spec.vector.tls.verifyCertificate

        boolean

        Default: true

      • spec.vector.tls.verifyHostname

        boolean

        Default: true

ClusterSecurityEventEnrichmentPlugin

Short names: csep

Scope: Cluster
Version: v1alpha1

• spec

  object

  Describes an enrichment plugin — an HTTP endpoint that resolves additional fields for outgoing SecurityEvents at runtime.

  • Internal plugins are served by the built-in enrichment-cache sidecar in the gateway pod. The module ships three Internal plugins: k8s-pod-info, k8s-container-info, k8s-nodeuser-info. Internal resources are managed by Deckhouse and cannot be created or modified.

  • External plugins are served by user-deployed pods in any namespace. The resource specifies the endpoint URL, the argument schema, the return field schema and, optionally, TLS and authentication settings.

  • spec.args

    array of objects

    Required value

    Input arguments, passed as query parameters, that the plugin accepts.

    Each argument has a name, a flag marking it as required, and a description.

    When a ShipperEnrichRule references this plugin, its args values are resolved from event fields (dot-paths) and sent as query parameters to the plugin endpoint.

    The controller validates that all required: true args are present in the referencing ShipperEnrichRule.

    • spec.args.description

      string

      Human-readable description of the argument.
    • spec.args.name

      string

      Argument name, used as the query parameter key.

      Minimal length: 1

    • spec.args.required

      boolean

      Whether the argument is required in ShipperEnrichRule.

      Default: true

  • spec.description

    string

    Human-readable description of the plugin.
  • spec.endpoint

    object

    HTTP endpoint configuration.

    Required for External plugins. For Internal plugins the parameter is ignored, because the sidecar URL is used automatically.

    • spec.endpoint.headers

      array of objects

      Static HTTP headers sent with each lookup request.
      • spec.endpoint.headers.name

        string

        Minimal length: 1

      • spec.endpoint.headers.value

        string
    • spec.endpoint.tls

      object

      TLS configuration for the HTTPS endpoint.
      • spec.endpoint.tls.caSecret

        string

        Name of a Secret in the module namespace (d8-security-events-manager) containing the CA certificate (key ca.crt). Used to verify the plugin endpoint’s TLS certificate.
      • spec.endpoint.tls.clientCertSecret

        string

        Name of a Secret in the module namespace containing the client certificate and key for mTLS (keys tls.crt, tls.key).
    • spec.endpoint.url

      string

      Required value

      Full HTTP(S) URL of the enrichment endpoint.

      The controller generates a request of the form GET <URL>?<ARGS AS QUERY PARAMS>. The URL must start with http:// or https://. To prevent SSRF, it must not reference cloud metadata endpoints such as 169.254.x.x or link-local addresses.

      Minimal length: 1

  • spec.readiness

    object

    Readiness probe of the plugin.

    The controller can probe this endpoint before including the plugin in the gateway configuration. If the endpoint is unreachable, the controller sets the NotReady status condition.

    • spec.readiness.expectedStatus

      integer

      Expected HTTP status code for a ready plugin.

      Default: 200

    • spec.readiness.path

      string

      HTTP path to probe, appended to endpoint.url.

      Default: /healthz

  • spec.returns

    object

    Required value

    Fields that the plugin returns in its JSON response.

    The list is used for validation: the value parameter in a referencing ShipperEnrichRule must match one of the fields[].name values listed here.

    • spec.returns.fields

      array of objects

      Required value
      • spec.returns.fields.description

        string

        Human-readable description of the field.
      • spec.returns.fields.name

        string

        Response field name.

        Minimal length: 1

      • spec.returns.fields.type

        string

        Field type.

        Allowed values: String, Int, Bool

  • spec.type

    string

    Required value

    Plugin type.

    • Internal — served by the built-in enrichment-cache sidecar, no endpoint required;
    • External — served by a user-deployed pod, requires endpoint.url.

    Allowed values: Internal, External

• status

  object

  Current status of this resource.
  • status.conditions

    array of objects

    Represents the latest available observations of an object’s state.
    • status.conditions.lastTransitionTime

      string
    • status.conditions.message

      string

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer
    • status.conditions.reason

      string

      Length: 1..1024

    • status.conditions.status

      string

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Maximum length: 316

  • status.observedGeneration

    integer

    The generation observed by the controller.

ClusterSecurityEventLoggingTransformationRules

Short names: cseltr

Scope: Cluster
Version: v1alpha1

• spec

  object

  Cluster-wide rules to transform raw log lines into structured objects (Vector events) before further processing.

  Namespaced SecurityEventLoggingTransformationRules (SELTR) take precedence over these rules when both match the same pod/container.

  • spec.file

    object

    Selection + shared transform for node file logs. Required when type is File.

    File match is performed against the Vector event field .file.

    • spec.file.paths

      array of strings

      Required value

      Exact file paths to match.
      • spec.file.paths.Element of the array

        string

        Minimal length: 1

    • spec.file.transform

      object

      Required value

      Shared transformation applied to every matched file log line.
      • spec.file.transform.drop_raw

        boolean

        Default: false

      • spec.file.transform.fields

        array of objects
        • spec.file.transform.fields.name

          string

          Field name in the parsed object.

          Minimal length: 1

        • spec.file.transform.fields.type

          string

          Target field type.

          Allowed values: String, Int, Float, Bool

      • spec.file.transform.parser

        object

        Required value

        Parser configuration that defines how to unpack the original log line.

        Parsing follows these rules:

        • parsing is best-effort, so errors and mismatches do not drop events;
        • for the Regex and Grok types, the first successfully matched pattern wins;
        • named captures are written into .parsed_data.
        • spec.file.transform.parser.grok

          object

          Grok parser configuration. Named fields are saved into .parsed_data.
          • spec.file.transform.parser.grok.customPatterns

            array of objects

            Custom grok pattern definitions (name -> regex). These are added to the built-in grok patterns.
            • spec.file.transform.parser.grok.customPatterns.key

              string
            • spec.file.transform.parser.grok.customPatterns.value

              string
          • spec.file.transform.parser.grok.patterns

            array of strings

            Required value

            Grok patterns to try in order. The first successfully matched pattern wins.
            • spec.file.transform.parser.grok.patterns.Element of the array

              string

              Minimal length: 1

        • spec.file.transform.parser.regex

          object

          Regex parser configuration. Only named capture groups are saved into .parsed_data.
          • spec.file.transform.parser.regex.patterns

            array of strings

            Required value

            Regex patterns to try in order. The first successfully matched pattern wins.
            • spec.file.transform.parser.regex.patterns.Element of the array

              string

              Minimal length: 1

        • spec.file.transform.parser.type

          string

          Required value

          Parser type.

          • JSON — parse the original log line as JSON with parse_json();
          • Regex — apply regular expressions and extract named capture groups;
          • Grok — apply grok patterns and extract named fields.

          Allowed values: JSON, Regex, Grok

  • spec.kubernetesPods

    object

    Selection + per-container transforms for Kubernetes pod logs. Required when type is KubernetesPods.
    • spec.kubernetesPods.containers

      array of objects

      Required value

      Per-container transformation rules.
      • spec.kubernetesPods.containers.drop_raw

        boolean

        If true, removes the original raw message field after parsing.

        Default: false

      • spec.kubernetesPods.containers.fields

        array of objects

        Field type conversions applied after parsing. Use them to enforce stable types for sinks such as Elasticsearch or ClickHouse.
        • spec.kubernetesPods.containers.fields.name

          string

          Field name in the parsed object.

          Minimal length: 1

        • spec.kubernetesPods.containers.fields.type

          string

          Target field type.

          Allowed values: String, Int, Float, Bool

      • spec.kubernetesPods.containers.name

        string

        Container name to apply this transformation to.

        Minimal length: 1

      • spec.kubernetesPods.containers.parser

        object

        Parser configuration that defines how to unpack the original log line.

        Parsing follows these rules:

        • parsing is best-effort, so errors and mismatches do not drop events;
        • for the Regex and Grok types, the first successfully matched pattern wins;
        • named captures are written into .parsed_data.
        • spec.kubernetesPods.containers.parser.grok

          object

          Grok parser configuration. Named fields are saved into .parsed_data.
          • spec.kubernetesPods.containers.parser.grok.customPatterns

            array of objects

            Custom grok pattern definitions (name -> regex). These are added to the built-in grok patterns.
            • spec.kubernetesPods.containers.parser.grok.customPatterns.key

              string
            • spec.kubernetesPods.containers.parser.grok.customPatterns.value

              string
          • spec.kubernetesPods.containers.parser.grok.patterns

            array of strings

            Required value

            Grok patterns to try in order. The first successfully matched pattern wins.
            • spec.kubernetesPods.containers.parser.grok.patterns.Element of the array

              string

              Minimal length: 1

        • spec.kubernetesPods.containers.parser.regex

          object

          Regex parser configuration. Only named capture groups are saved into .parsed_data.
          • spec.kubernetesPods.containers.parser.regex.patterns

            array of strings

            Required value

            Regex patterns to try in order. The first successfully matched pattern wins.
            • spec.kubernetesPods.containers.parser.regex.patterns.Element of the array

              string

              Minimal length: 1

        • spec.kubernetesPods.containers.parser.type

          string

          Required value

          Parser type.

          • JSON — parse the original log line as JSON with parse_json();
          • Regex — apply regular expressions and extract named capture groups;
          • Grok — apply grok patterns and extract named fields.

          Allowed values: JSON, Regex, Grok

    • spec.kubernetesPods.labelSelector

      object

      Required value

      Pod label selector.
      • spec.kubernetesPods.labelSelector.matchExpressions

        array of objects

        List of label selector requirements.
        • spec.kubernetesPods.labelSelector.matchExpressions.key

          string
        • spec.kubernetesPods.labelSelector.matchExpressions.operator

          string

          Allowed values: In, NotIn, Exists, DoesNotExist

        • spec.kubernetesPods.labelSelector.matchExpressions.values

          array of strings
      • spec.kubernetesPods.labelSelector.matchLabels

        object

        Map of label key to value.
    • spec.kubernetesPods.namespaceSelector

      object

      Namespace selection (subset of ClusterLoggingConfig). Only matchNames/excludeNames are supported.
      • spec.kubernetesPods.namespaceSelector.excludeNames

        array of strings
      • spec.kubernetesPods.namespaceSelector.matchNames

        array of strings
  • spec.type

    string

    Required value

    Input type the rules apply to. KubernetesPods — match pod/container logs. File — match node file logs.

    Allowed values: KubernetesPods, File

• status

  object

  Current status of this resource.
  • status.conditions

    array of objects

    Represents the latest available observations of an object’s state.
    • status.conditions.lastTransitionTime

      string
    • status.conditions.message

      string

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer
    • status.conditions.reason

      string

      Length: 1..1024

    • status.conditions.status

      string

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Maximum length: 316

  • status.observedGeneration

    integer

    The generation observed by the controller.

ClusterSecurityEventShipper

Short names: cses

Scope: Cluster
Version: v1alpha1

• spec

  array of objects

  Cluster-wide pipelines for extracting security events from node files or pod logs. Each pipeline item describes the source and one or more event definitions (produces).
  • spec.input

    object
    • spec.input.files

      array of strings

      Node file paths (required for type File).
    • spec.input.kubernetesPods

      object

      Pod selection for cluster-wide collection.
      • spec.input.kubernetesPods.labelSelector

        object

        Required value

        Kubernetes-style label selector.
        • spec.input.kubernetesPods.labelSelector.matchExpressions

          array of objects

          List of label selector requirements.
          • spec.input.kubernetesPods.labelSelector.matchExpressions.key

            string
          • spec.input.kubernetesPods.labelSelector.matchExpressions.operator

            string

            Allowed values: In, NotIn, Exists, DoesNotExist

          • spec.input.kubernetesPods.labelSelector.matchExpressions.values

            array of strings
        • spec.input.kubernetesPods.labelSelector.matchLabels

          object

          Map of label key to value.
      • spec.input.kubernetesPods.namespace

        string

        Namespace to collect pod logs from (legacy exact namespace match).

        Minimal length: 1

      • spec.input.kubernetesPods.namespaceSelector

        object

        Namespace selector for cluster pod log collection.

        • If matchNames is set, only these namespaces are included.
        • If excludeNames is set, these namespaces are excluded.
        • If both are empty, all namespaces are matched.
        • spec.input.kubernetesPods.namespaceSelector.excludeNames

          array of strings

          Explicitly excluded namespace names.
        • spec.input.kubernetesPods.namespaceSelector.matchNames

          array of strings

          Explicitly included namespace names.
    • spec.input.type

      string

      Required value

      File — read from node files. KubernetesPods — read from pod logs (cluster-wide; labelSelector required; namespace or namespaceSelector optional).

      Allowed values: File, KubernetesPods

  • spec.parser

    array of objects

    Parser rules for best-effort parsing of raw log line .message into .parsed_data.

    • For input.type: KubernetesPods: this repeats SecurityEventLoggingTransformationRules.spec.containers[]. Match is performed by .namespace + .container + .pod_labels.
    • For input.type: File: set name: file and the rule will be applied when .file matches one of input.files.

    Container selection happens on the log-shipper side via labelFilter.

    • spec.parser.drop_raw

      boolean

      If true, removes the original raw message field after parsing.

      Default: false

    • spec.parser.fields

      array of objects

      Field type conversions applied after parsing.
      • spec.parser.fields.name

        string

        Field name in the parsed object.

        Minimal length: 1

      • spec.parser.fields.type

        string

        Target field type.

        Allowed values: String, Int, Float, Bool

    • spec.parser.name

      string

      Container name (or file for file input).

      Minimal length: 1

    • spec.parser.parser

      object

      Parser configuration.
      • spec.parser.parser.grok

        object
        • spec.parser.parser.grok.customPatterns

          array of objects
          • spec.parser.parser.grok.customPatterns.key

            string
          • spec.parser.parser.grok.customPatterns.value

            string
        • spec.parser.parser.grok.patterns

          array of strings

          Required value
          • spec.parser.parser.grok.patterns.Element of the array

            string

            Minimal length: 1

      • spec.parser.parser.regex

        object
        • spec.parser.parser.regex.patterns

          array of strings

          Required value
          • spec.parser.parser.regex.patterns.Element of the array

            string

            Minimal length: 1

      • spec.parser.parser.type

        string

        Required value

        Parser type.

        Allowed values: JSON, Regex, Grok

  • spec.parserRef

    string

    Name of ClusterSecurityEventLoggingTransformationRules (CSELTR) object to use as parser rule source.

    Used only when parser is not set.

    Minimal length: 1

  • spec.produces

    array of objects

    List of produced security events for this source.
    • spec.produces.enrich

      array of objects

      Enrichment rules for adding extra fields into outgoing SecurityEvent.

      Each rule writes into a destination field path (target). Sources:

      • Static: write a literal string from value.
      • Plugin: resolve a field at runtime via HTTP lookup to the enrichment-cache sidecar (in-memory Pod/NodeUser cache, no API server call per event). Plugins:
        • k8s-pod-info, k8s-container-info: resolve Pod fields. Supports two lookup modes:
          • Pod-name mode: args pod_name + namespace.
          • Container-ID mode: arg container_id (resolves namespace, name, or serviceAccountName from the container runtime ID).
        • k8s-nodeuser-info: resolve a static-user username (nodeusers.deckhouse.io) by uid. Arg uid (resolves the NodeUser metadata.name matching spec.uid).

      Enrich rules are applied after transform, so they override transform when targeting the same field.

      • spec.produces.enrich.args

        array of objects

        Plugin arguments as key/value pairs. The key must match an arg name declared by the referenced ClusterSecurityEventEnrichmentPlugin CR (spec.args[].name). The value is a dot-path in the event resolved with the same logic as transform rules: a @root. prefix reads from the event root, otherwise the value is read from .parsed_data.

        At runtime, each arg becomes a query parameter sent to the plugin endpoint: GET <endpoint>?<arg1>=<val1>&<arg2>=<val2>.

        For built-in plugins:

        • k8s-pod-info: pod_name + namespace (both required).
        • k8s-container-info: container_id (required; runtime prefixes like containerd:// are stripped automatically).
        • k8s-nodeuser-info: uid (required; system UID from the event).
        • spec.produces.enrich.args.key

          string
        • spec.produces.enrich.args.value

          string
      • spec.produces.enrich.plugin

        string

        Plugin name (required for source=Plugin). References an existing ClusterSecurityEventEnrichmentPlugin resource by its metadata.name.

        Built-in Internal plugins shipped with the module:

        • k8s-pod-info — resolve Pod fields by pod name + namespace.
        • k8s-container-info — resolve Pod fields by container runtime ID.
        • k8s-nodeuser-info — resolve static-user username (nodeusers.deckhouse.io) by uid.

        To register custom enrichment endpoints, create ClusterSecurityEventEnrichmentPlugin resources of type External.

      • spec.produces.enrich.source

        string

        Enrichment source type.

        Allowed values: Static, Plugin

      • spec.produces.enrich.target

        string

        Destination field path in outgoing SecurityEvent (dot-separated).

        Minimal length: 1

      • spec.produces.enrich.value

        string

        For Static source: literal string to be written to target.

        For Plugin source: the response field to extract from the plugin’s JSON response. Must match one of the returns.fields[].name declared by the referenced ClusterSecurityEventEnrichmentPlugin resource. For example: serviceAccountName, name, namespace (k8s-pod-info / k8s-container-info), username (k8s-nodeuser-info).

    • spec.produces.eventCode

      string

      Event code (references SecurityEventDefinition.spec.code).

      Minimal length: 1

    • spec.produces.extract

      object

      Detection rule for this produced event.

      This structure maps 1:1 into log-shipper ClusterLoggingConfig.spec.labelFilter item.

      Notes:

      • values is required for In, NotIn, Regex, NotRegex.
      • values must be omitted/empty for Exists, DoesNotExist.

      Allowed field values are message plus log-shipper metadata labels. Kubernetes: pod, namespace, pod_labels, pod_ip, image, container, node, pod_owner, node_group. File: host, host_ip, file.

      • spec.produces.extract.field

        string

        Required value

        Field name for filtering (same as ClusterLoggingConfig labelFilter.field). Typical values: message, file, namespace.

        Minimal length: 1

      • spec.produces.extract.operator

        string

        Required value

        Operator for field comparison (same as ClusterLoggingConfig labelFilter.operator).

        Allowed values: In, NotIn, Regex, NotRegex, Exists, DoesNotExist

      • spec.produces.extract.values

        array of strings

        Array of values or regexes for corresponding operations (same as ClusterLoggingConfig labelFilter.values).
    • spec.produces.transform

      array of objects

      Field mapping for transforming parsed raw logs into outgoing SecurityEvent.

      Keys are destination field paths in the outgoing event (dot-separated). Values are source field paths inside the parsed raw object (dot-separated, relative to .parsed_data). To read from root-level fields, use the @root. prefix (for example: metadata.extra.host_ip: @root.host_ip).

      Example: pod.name: pod_name will copy .parsed_data.pod_name into .pod.name.

      • spec.produces.transform.key

        string
      • spec.produces.transform.value

        string
  • spec.producesDefaults

    object

    Default mappings applied to all items in produces[] of this pipeline item.

    Precedence:

    • transform: keys are merged; defaults first, then produces[].transform overwrites.
    • enrich: used only when produces[].enrich is omitted.
    • spec.producesDefaults.enrich

      array of objects

      Default enrich rules (see produces[].enrich).
      • spec.producesDefaults.enrich.args

        array of objects

        Plugin arguments as key/value pairs. The key must match an arg name declared by the referenced ClusterSecurityEventEnrichmentPlugin CR (spec.args[].name). The value is a dot-path in the event resolved with the same logic as transform rules: a @root. prefix reads from the event root, otherwise the value is read from .parsed_data.

        At runtime, each arg becomes a query parameter sent to the plugin endpoint: GET <endpoint>?<arg1>=<val1>&<arg2>=<val2>.

        For built-in plugins:

        • k8s-pod-info: pod_name + namespace (both required).
        • k8s-container-info: container_id (required; runtime prefixes like containerd:// are stripped automatically).
        • k8s-nodeuser-info: uid (required; system UID from the event).
        • spec.producesDefaults.enrich.args.key

          string
        • spec.producesDefaults.enrich.args.value

          string
      • spec.producesDefaults.enrich.plugin

        string

        Plugin name (required for source=Plugin). References an existing ClusterSecurityEventEnrichmentPlugin resource by its metadata.name.

        Built-in Internal plugins shipped with the module:

        • k8s-pod-info — resolve Pod fields by pod name + namespace.
        • k8s-container-info — resolve Pod fields by container runtime ID.
        • k8s-nodeuser-info — resolve static-user username (nodeusers.deckhouse.io) by uid.

        To register custom enrichment endpoints, create ClusterSecurityEventEnrichmentPlugin resources of type External.

      • spec.producesDefaults.enrich.source

        string

        Enrichment source type.

        Allowed values: Static, Plugin

      • spec.producesDefaults.enrich.target

        string

        Destination field path in outgoing SecurityEvent (dot-separated).

        Minimal length: 1

      • spec.producesDefaults.enrich.value

        string

        For Static source: literal string to be written to target.

        For Plugin source: the response field to extract from the plugin’s JSON response. Must match one of the returns.fields[].name declared by the referenced ClusterSecurityEventEnrichmentPlugin resource. For example: serviceAccountName, name, namespace (k8s-pod-info / k8s-container-info), username (k8s-nodeuser-info).

    • spec.producesDefaults.transform

      array of objects

      Default field mapping (see produces[].transform).
      • spec.producesDefaults.transform.key

        string
      • spec.producesDefaults.transform.value

        string
  • spec.source

    string

    Source identifier (used for enable/disable via ClusterSecurityEventConfig).

    Minimal length: 1

• status

  object

  Current status of this resource.
  • status.conditions

    array of objects

    Represents the latest available observations of an object’s state.
    • status.conditions.lastTransitionTime

      string
    • status.conditions.message

      string

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer
    • status.conditions.reason

      string

      Length: 1..1024

    • status.conditions.status

      string

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Maximum length: 316

  • status.observedGeneration

    integer

    The generation observed by the controller.

PodSecurityEventShipper

Short names: pses

Scope: Namespaced
Version: v1alpha1

• spec

  array of objects

  Namespaced pipelines for extracting security events from pod logs of this namespace. Namespace is implied and equals the PodSecurityEventShipper namespace.
  • spec.input

    object
    • spec.input.kubernetesPods

      object

      Required value
      • spec.input.kubernetesPods.labelSelector

        object

        Required value

        Kubernetes-style label selector.
        • spec.input.kubernetesPods.labelSelector.matchExpressions

          array of objects

          List of label selector requirements.
          • spec.input.kubernetesPods.labelSelector.matchExpressions.key

            string
          • spec.input.kubernetesPods.labelSelector.matchExpressions.operator

            string

            Allowed values: In, NotIn, Exists, DoesNotExist

          • spec.input.kubernetesPods.labelSelector.matchExpressions.values

            array of strings
        • spec.input.kubernetesPods.labelSelector.matchLabels

          object

          Map of label key to value.
    • spec.input.type

      string

      Required value

      Allowed values: KubernetesPods

  • spec.parser

    array of objects

    Parser rules (same shape as SecurityEventLoggingTransformationRules.spec.containers[]). Used by the gateway for best-effort parsing of raw logs .message into .parsed_data before applying transform mappings. Note: container is selected by log-shipper via labelFilter; name is the container name these rules apply to.
    • spec.parser.drop_raw

      boolean

      If true, removes the original raw message field after parsing.

      Default: false

    • spec.parser.fields

      array of objects

      Field type conversions applied after parsing.
      • spec.parser.fields.name

        string

        Field name in the parsed object.

        Minimal length: 1

      • spec.parser.fields.type

        string

        Target field type.

        Allowed values: String, Int, Float, Bool

    • spec.parser.name

      string

      Container name.

      Minimal length: 1

    • spec.parser.parser

      object

      Parser configuration.
      • spec.parser.parser.grok

        object

        Grok parser configuration.
        • spec.parser.parser.grok.customPatterns

          array of objects

          Custom grok pattern definitions (name -> regex).
          • spec.parser.parser.grok.customPatterns.key

            string
          • spec.parser.parser.grok.customPatterns.value

            string
        • spec.parser.parser.grok.patterns

          array of strings

          Required value

          Grok patterns to try in order.
          • spec.parser.parser.grok.patterns.Element of the array

            string

            Minimal length: 1

      • spec.parser.parser.regex

        object

        Regex parser configuration.
        • spec.parser.parser.regex.patterns

          array of strings

          Required value

          Regex patterns to try in order.
          • spec.parser.parser.regex.patterns.Element of the array

            string

            Minimal length: 1

      • spec.parser.parser.type

        string

        Required value

        Parser type.

        • JSON — parse the original log line as JSON;
        • Regex — apply regular expressions and extract named capture groups;
        • Grok — apply grok patterns and extract named fields.

        Allowed values: JSON, Regex, Grok

  • spec.parserRef

    string

    Name of SecurityEventLoggingTransformationRules (SELTR) resource in the same namespace to use as parser rules. Used only when parser is not set.

    Minimal length: 1

  • spec.produces

    array of objects

    List of produced security events for this source.
    • spec.produces.enrich

      array of objects

      Enrichment rules for adding extra fields into outgoing SecurityEvent.

      Each rule writes into a destination field path (target). Sources:

      • Static: write a literal string from value.
      • Plugin: resolve a field at runtime via HTTP lookup to the enrichment-cache sidecar (in-memory Pod/NodeUser cache, no API server call per event). Plugins:
        • k8s-pod-info, k8s-container-info: resolve Pod fields. Supports two lookup modes:
          • Pod-name mode: args pod_name + namespace.
          • Container-ID mode: arg container_id (resolves namespace, name, or serviceAccountName from the container runtime ID).
        • k8s-nodeuser-info: resolve a static-user username (nodeusers.deckhouse.io) by uid. Arg uid (resolves the NodeUser metadata.name matching spec.uid).

      Enrich rules are applied after transform, so they override transform when targeting the same field.

      • spec.produces.enrich.args

        array of objects

        Plugin arguments as key/value pairs. The key must match an arg name declared by the referenced ClusterSecurityEventEnrichmentPlugin CR (spec.args[].name). The value is a dot-path in the event resolved with the same logic as transform rules: a @root. prefix reads from the event root, otherwise the value is read from .parsed_data.

        At runtime, each arg becomes a query parameter sent to the plugin endpoint: GET <endpoint>?<arg1>=<val1>&<arg2>=<val2>.

        For built-in plugins:

        • k8s-pod-info: pod_name + namespace (both required).
        • k8s-container-info: container_id (required; runtime prefixes like containerd:// are stripped automatically).
        • k8s-nodeuser-info: uid (required; system UID from the event).
        • spec.produces.enrich.args.key

          string
        • spec.produces.enrich.args.value

          string
      • spec.produces.enrich.plugin

        string

        Plugin name (required for source=Plugin). References an existing ClusterSecurityEventEnrichmentPlugin resource by its metadata.name.

        Built-in Internal plugins shipped with the module:

        • k8s-pod-info — resolve Pod fields by pod name + namespace.
        • k8s-container-info — resolve Pod fields by container runtime ID.
        • k8s-nodeuser-info — resolve static-user username (nodeusers.deckhouse.io) by uid.

        To register custom enrichment endpoints, create ClusterSecurityEventEnrichmentPlugin resources of type External.

      • spec.produces.enrich.source

        string

        Enrichment source type.

        Allowed values: Static, Plugin

      • spec.produces.enrich.target

        string

        Destination field path in outgoing SecurityEvent (dot-separated).

        Minimal length: 1

      • spec.produces.enrich.value

        string

        For Static source: literal string to be written to target.

        For Plugin source: the response field to extract from the plugin’s JSON response. Must match one of the returns.fields[].name declared by the referenced ClusterSecurityEventEnrichmentPlugin resource. For example: serviceAccountName, name, namespace (k8s-pod-info / k8s-container-info), username (k8s-nodeuser-info).

    • spec.produces.eventCode

      string

      Event code (references SecurityEventDefinition.spec.code).

      Minimal length: 1

    • spec.produces.extract

      object

      Detection rule for this produced event.

      This structure maps 1:1 into log-shipper PodLoggingConfig.spec.labelFilter item.

      Notes:

      • values is required for In, NotIn, Regex, NotRegex.
      • values must be omitted/empty for Exists, DoesNotExist.

      Allowed field values are message plus log-shipper metadata labels. Kubernetes: pod, namespace, pod_labels, pod_ip, image, container, node, pod_owner, node_group. File: host, host_ip, file.

      • spec.produces.extract.field

        string

        Required value

        Field name for filtering (same as PodLoggingConfig labelFilter.field). Typical values: message, container, namespace.

        Minimal length: 1

      • spec.produces.extract.operator

        string

        Required value

        Operator for field comparison (same as PodLoggingConfig labelFilter.operator).

        Allowed values: In, NotIn, Regex, NotRegex, Exists, DoesNotExist

      • spec.produces.extract.values

        array of strings

        Array of values or regexes for corresponding operations (same as PodLoggingConfig labelFilter.values).
    • spec.produces.transform

      array of objects

      Field mapping for transforming parsed raw logs into outgoing SecurityEvent.

      Keys are destination field paths in the outgoing event (dot-separated). Values are source field paths inside the parsed raw object (dot-separated, relative to .parsed_data). To read from root-level fields, use the @root. prefix (for example: metadata.extra.host_ip: @root.host_ip).

      Example: pod.name: pod_name will copy .parsed_data.pod_name into .pod.name.

      • spec.produces.transform.key

        string
      • spec.produces.transform.value

        string
  • spec.producesDefaults

    object

    Default mappings applied to all items in produces[] of this pipeline item.

    Precedence:

    • transform: keys are merged; defaults first, then produces[].transform overwrites.
    • enrich: used only when produces[].enrich is omitted.
    • spec.producesDefaults.enrich

      array of objects

      Default enrich rules (see produces[].enrich).
      • spec.producesDefaults.enrich.args

        array of objects

        Plugin arguments as key/value pairs. The key must match an arg name declared by the referenced ClusterSecurityEventEnrichmentPlugin CR (spec.args[].name). The value is a dot-path in the event resolved with the same logic as transform rules: a @root. prefix reads from the event root, otherwise the value is read from .parsed_data.

        At runtime, each arg becomes a query parameter sent to the plugin endpoint: GET <endpoint>?<arg1>=<val1>&<arg2>=<val2>.

        For built-in plugins:

        • k8s-pod-info: pod_name + namespace (both required).
        • k8s-container-info: container_id (required; runtime prefixes like containerd:// are stripped automatically).
        • k8s-nodeuser-info: uid (required; system UID from the event).
        • spec.producesDefaults.enrich.args.key

          string
        • spec.producesDefaults.enrich.args.value

          string
      • spec.producesDefaults.enrich.plugin

        string

        Plugin name (required for source=Plugin). References an existing ClusterSecurityEventEnrichmentPlugin resource by its metadata.name.

        Built-in Internal plugins shipped with the module:

        • k8s-pod-info — resolve Pod fields by pod name + namespace.
        • k8s-container-info — resolve Pod fields by container runtime ID.
        • k8s-nodeuser-info — resolve static-user username (nodeusers.deckhouse.io) by uid.

        To register custom enrichment endpoints, create ClusterSecurityEventEnrichmentPlugin resources of type External.

      • spec.producesDefaults.enrich.source

        string

        Enrichment source type.

        Allowed values: Static, Plugin

      • spec.producesDefaults.enrich.target

        string

        Destination field path in outgoing SecurityEvent (dot-separated).

        Minimal length: 1

      • spec.producesDefaults.enrich.value

        string

        For Static source: literal string to be written to target.

        For Plugin source: the response field to extract from the plugin’s JSON response. Must match one of the returns.fields[].name declared by the referenced ClusterSecurityEventEnrichmentPlugin resource. For example: serviceAccountName, name, namespace (k8s-pod-info / k8s-container-info), username (k8s-nodeuser-info).

    • spec.producesDefaults.transform

      array of objects

      Default field mapping (see produces[].transform).
      • spec.producesDefaults.transform.key

        string
      • spec.producesDefaults.transform.value

        string
  • spec.source

    string

    Source identifier (used for enable/disable via ClusterSecurityEventConfig).

    Minimal length: 1

• status

  object

  Current status of this resource.
  • status.conditions

    array of objects

    Represents the latest available observations of an object’s state.
    • status.conditions.lastTransitionTime

      string
    • status.conditions.message

      string

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer
    • status.conditions.reason

      string

      Length: 1..1024

    • status.conditions.status

      string

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Maximum length: 316

  • status.observedGeneration

    integer

    The generation observed by the controller.

SecurityEvent

Scope: Cluster
Version: v1

• actor

  object

  Actor (subject) that performed the action.
  • actor.id

    string

    Actor identifier.
  • actor.type

    string

    Actor type.

    Allowed values: User, ServiceAccount, System

• event

  object

  Event classification and details.
  • event.category

    string

    Required value

    Event category.

    Allowed values: Auth, Rbac, Runtime, Network, Config

  • event.code

    string

    Required value

    Event code.
  • event.description

    string

    Human-readable event description.
  • event.outcome

    string

    Required value

    Event outcome.

    Allowed values: Success, Failure, Denied

  • event.severity

    string

    Required value

    Event severity.

    Allowed values: Low, Medium, High, Critical

• eventMetadata

  object

  Additional metadata.
  • eventMetadata.cluster

    string

    Required value

    Cluster identifier.
  • eventMetadata.extra

    array of objects

    Extra key-value metadata.
    • eventMetadata.extra.key

      string
    • eventMetadata.extra.value

      string
  • eventMetadata.node

    string

    Node name.
• id

  string

  Unique event identifier.
• object

  object

  Object the event is related to.
  • object.name

    string

    Object name.
  • object.namespace

    string

    Object namespace.
  • object.type

    string

    Object type.
• source

  object

  Source identification for the event.
  • source.component

    string

    Required value

    Component name, for example kube-apiserver.
  • source.instance

    string

    Instance identifier.
• timestamp

  string

  Event timestamp.

SecurityEventDefinition

Short names: sed

Scope: Cluster
Version: v1alpha1

• spec

  object

  Describes a possible security event.
  • spec.category

    string

    Required value

    Event category.

    Allowed values: Auth, Rbac, Runtime, Network, Config

  • spec.code

    string

    Required value

    Event code.

    Minimal length: 1

  • spec.description

    string

    Required value

    Human-readable description.

    Minimal length: 1

  • spec.descriptionRu

    string

    Human-readable description in Russian.
  • spec.fields

    array of objects

    List of fields that the event may contain.
    • spec.fields.name

      string

      Field name.

      Minimal length: 1

    • spec.fields.required

      boolean

      Whether the field is required.

      Default: true

  • spec.metadata

    object

    Metadata related to the rule
  • spec.severity

    string

    Required value

    Event severity.

    Allowed values: Low, Medium, High, Critical

  • spec.source

    string

    Required value

    Source identifier.

    Minimal length: 1

• status

  object

  Current status of this resource.
  • status.conditions

    array of objects

    Represents the latest available observations of an object’s state.
    • status.conditions.lastTransitionTime

      string
    • status.conditions.message

      string

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer
    • status.conditions.reason

      string

      Length: 1..1024

    • status.conditions.status

      string

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Maximum length: 316

  • status.observedGeneration

    integer

    The generation observed by the controller.

SecurityEventLoggingTransformationRules

Short names: seltr

Scope: Namespaced
Version: v1alpha1

• spec

  object

  Namespaced rules to transform raw log lines into structured objects (Vector events) before further processing.
  • spec.containers

    array of objects

    Required value

    Per-container transformation rules.
    • spec.containers.drop_raw

      boolean

      If true, removes the original raw message field after parsing.

      Default: false

    • spec.containers.fields

      array of objects

      Field type conversions applied after parsing. Use them to enforce stable types for sinks such as Elasticsearch or ClickHouse.
      • spec.containers.fields.name

        string

        Field name in the parsed object.

        Minimal length: 1

      • spec.containers.fields.type

        string

        Target field type.

        Allowed values: String, Int, Float, Bool

    • spec.containers.name

      string

      Container name to apply this transformation to.

      Minimal length: 1

    • spec.containers.parser

      object

      Parser configuration that defines how to unpack the original log line.

      Parsing follows these rules:

      • parsing is best-effort, so errors and mismatches do not drop events;
      • for the Regex and Grok types, the first successfully matched pattern wins;
      • named captures are written into .parsed_data.
      • spec.containers.parser.grok

        object

        Grok parser configuration. Named fields are saved into .parsed_data.
        • spec.containers.parser.grok.customPatterns

          array of objects

          Custom grok pattern definitions (name -> regex). These are added to the built-in grok patterns.
          • spec.containers.parser.grok.customPatterns.key

            string
          • spec.containers.parser.grok.customPatterns.value

            string
        • spec.containers.parser.grok.patterns

          array of strings

          Required value

          Grok patterns to try in order. The first successfully matched pattern wins.
          • spec.containers.parser.grok.patterns.Element of the array

            string

            Minimal length: 1

      • spec.containers.parser.regex

        object

        Regex parser configuration. Only named capture groups are saved into .parsed_data.
        • spec.containers.parser.regex.patterns

          array of strings

          Required value

          Regex patterns to try in order. The first successfully matched pattern wins.
          • spec.containers.parser.regex.patterns.Element of the array

            string

            Minimal length: 1

      • spec.containers.parser.type

        string

        Required value

        Parser type.

        • JSON — parse the original log line as JSON with parse_json();
        • Regex — apply regular expressions and extract named capture groups;
        • Grok — apply grok patterns and extract named fields.

        Allowed values: JSON, Regex, Grok

  • spec.selector

    object

    Required value

    Pod label selector.
    • spec.selector.matchExpressions

      array of objects

      List of label selector requirements.
      • spec.selector.matchExpressions.key

        string
      • spec.selector.matchExpressions.operator

        string

        Allowed values: In, NotIn, Exists, DoesNotExist

      • spec.selector.matchExpressions.values

        array of strings
    • spec.selector.matchLabels

      object

      Map of label key to value.
• status

  object

  Current status of this resource.
  • status.conditions

    array of objects

    Represents the latest available observations of an object’s state.
    • status.conditions.lastTransitionTime

      string
    • status.conditions.message

      string

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer
    • status.conditions.reason

      string

      Length: 1..1024

    • status.conditions.status

      string

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Maximum length: 316

  • status.observedGeneration

    integer

    The generation observed by the controller.