Custom resources | security-events-manager

The module lifecycle stage: Experimental

The module has requirements for installation

The Deckhouse Platform installs CRDs but does not remove them when a module is disabled. If you no longer need the created CRDs, delete them.

ClusterSecurityEventAlertRule

Short names: csear

Scope: Cluster
Version: v1alpha1

spec

object
Turns a pattern in security events into a Prometheus alert.

A rule looks for a pattern in the collected security events, for example “one actor read more than 20 secrets in 5 minutes”, and raises a named alert once the pattern occurs. The pattern is expressed as a LogQL query and evaluated against the cluster Loki, so the cluster-loki destination must be enabled for any rule to work.

Rules are organized into groups. A group has no effect on evaluation: each rule is evaluated on its own, independently of the other rules in its group.

A firing rule raises the D8SecurityEventAlertFiring alert, which reaches the operator the same way as any other cluster alert: as a ClusterAlert object, in the console, and through the cluster alert delivery. Delivery requires no configuration.

The structure mirrors PrometheusRule: named groups, each with an interval and a list of rules carrying alert, expr, for, labels and annotations. The difference is that expr is written in LogQL rather than in PromQL.
- spec.groups
  
  array of objects
  Required value
  
  List of rule groups.
  
  A group consists of a name and a list of rules. It does not affect how or when its rules are evaluated and only keeps related rules together. The same structure as spec.groups of PrometheusRule.
  - spec.groups.interval
    
    string
    How often every rule in this group is evaluated against Loki.
    
    Digits followed by s, m or h, for example 30s. The default is 30s.
    
    Default: 30s
    
    Pattern: ^[0-9]+(s|m|h)$
  - spec.groups.name
    
    string
    Group name.
    
    Does not affect evaluation and is used only in the output of d8 k get -o yaml and in logs, to identify the group.
    
    Length: 1..253
  - spec.groups.rules
    
    array of objects
    Alert rules in this group.
    - spec.groups.rules.aggregation
      
      object
      Counting parameters of the rule.
      
      Events are grouped by groupBy, and the alert fires as soon as a group reaches threshold within window. The window slides continuously: it is recomputed against the logs stored in Loki on every evaluation rather than kept as counter state.
      
      Requires match, because a rule based on expr expresses grouping and the threshold in the query itself. Without aggregation, a rule based on match fires on every matched event.
      - spec.groups.rules.aggregation.groupBy
        
        array of strings
        Required value
        
        Event fields that identify a group.
        
        Values of these fields become alert labels, so the set of allowed fields is limited to attributes with low cardinality. Using an object name as a key, for example, would create a separate group per event, cause unbounded growth of the evaluator and overload the alert receiver.
        
        spec.groups.rules.aggregation.groupBy.Element of the array
        
        string
        Event field to group by.
        
        Each value is named after the field it reads in LogQL:
        
        EventCode reads event_code;
        
        EventSeverity reads event_severity;
        
        EventCategory reads event_category;
        
        SourceComponent reads source_component;
        
        ActorID reads actor_id;
        
        ActorSourceIP reads actor_sourceIP;
        
        ObjectNamespace reads object_namespace;
        
        ObjectType reads object_type.
        
        Allowed values: EventCode, EventSeverity, EventCategory, SourceComponent, ActorID, ActorSourceIP, ObjectNamespace, ObjectType
      - spec.groups.rules.aggregation.threshold
        
        integer
        Required value
        
        Number of events in a group that triggers the alert.
        
        To raise an alert on every event, use a rule without the aggregation block.
        
        Allowed values: 2 <= X
      - spec.groups.rules.aggregation.window
        
        string
        Required value
        
        Time span over which a group keeps counting before it is forgotten.
        
        Digits followed by s, m or h, for example 5m. Choose the span within which the described behaviour occurs: minutes for a brute-force attempt, hours for a slow sweep.
        
        Pattern: ^[0-9]+(s|m|h)$
    - spec.groups.rules.alert
      
      string
      Short name of what the rule detects, for example MassSecretAccess.
      
      The name identifies the rule in the alert label of the produced metric, in logs and in the status of the rule itself. The equivalent of the alert field of PrometheusRule.
      
      Maximum length: 253
      
      Pattern: ^[A-Za-z][A-Za-z0-9_]*$
    - spec.groups.rules.annotations
      
      object
      Text shown alongside the alert once it fires.
      
      Unlike labels, annotations do not identify the alert and are intended to be read by a human. The field is required: every rule must state in summary what it detected, and that text is what the fired alert carries.
      
      A value may quote the data that made the rule fire, the same way Prometheus templates the annotations of PrometheusRule. Use {{ $labels.<NAME> }} for one of the labels that expr grouped by and {{ $value }} for the number that expr produced, for example {{ $labels.actor_id }} read secrets {{ $value }} times.
      
      The rendered text is passed as a label of the firing metric, so each distinct rendering becomes a separate Prometheus series for the whole retention period. In a rule whose count changes on every evaluation, {{ $value }} therefore adds a series per interval. Prefer {{ $labels.<NAME> }}, which stays stable for as long as the group exists.
      - spec.groups.rules.annotations.description
        
        string
        Detailed description, shown in the description annotation of the alert.
        
        State what to check and where, the way a runbook does.
        
        Maximum length: 4096
      - spec.groups.rules.annotations.summary
        
        string
        Required value
        
        Short one-line summary, shown in the summary annotation of the alert, for example One actor read an unusual number of secrets.
        
        Maximum length: 512
    - spec.groups.rules.expr
      
      string
      LogQL query that determines whether the rule fires.
      
      Each rule sets exactly one of expr and match. Use expr when the structured fields of match cannot express the required condition.
      
      The query must be a metric query, that is, one that returns a number rather than a list of log lines, and must include the comparison itself. For example:
      
      sum by (actor_id) ( count_over_time({source_component="kube-audit", event_code="K8S_SECRET_ACCESSED", actor_id!=""} [5m]) ) > 20
      The query above consists of the following parts:
      
      {source_component="kube-audit", ...} selects the log streams to search;
      
      count_over_time(...[5m]) counts the matching lines over the last 5 minutes;
      
      sum by (actor_id) keeps a separate count per actor instead of summing the events of all actors;
      
      > 20 is the condition itself: the rule fires once the count for any actor exceeds 20.
      
      No further processing of the number is required: reaching the threshold set in the query is what firing means.
      
      Every field listed in sum by (...) or a similar aggregation becomes a label of the resulting alert. Keep that list short and limited to fields with a bounded set of values, as described in the section on the specifics of writing rules on the examples page.
      
      The equivalent of the expr field of PrometheusRule, written in LogQL rather than in PromQL.
      
      Length: 1..8192
    - spec.groups.rules.for
      
      string
      Time span over which expr must keep matching without a break before the rule fires.
      
      The field filters out one-off spikes: with for: 5m, a spike that lasts a couple of minutes and then stops does not fire the rule at all.
      
      Digits followed by s, m or h, for example 5m. The default is 0s, meaning that the rule fires on the first match of expr, with no waiting period.
      
      The pending and firing semantics are the same as for the for field of PrometheusRule.
      
      Default: 0s
      
      Pattern: ^[0-9]+(s|m|h)$
    - spec.groups.rules.labels
      
      object
      Additional alert labels.
      
      They are added next to rule, alert, severity_level and the fields that expr groups by. Labels identify the alert: two alerts with the same labels are the same alert.
    - spec.groups.rules.match
      
      object
      Security events the rule applies to.
      
      Criteria are combined with AND.
      
      Each rule sets exactly one of expr and match. The match and aggregation fields are compiled into the same kind of LogQL query that expr would hold, so they are a form for building that query rather than a separate evaluation path. Use expr directly when a rule requires a field that this form does not cover or a line filter more specific than an exact or glob match.
      - spec.groups.rules.match.actorType
        
        string
        Kind of subject the rule is narrowed to.
        
        ServiceAccounts keeps only the actors matching system:serviceaccount:*. NonServiceAccounts keeps all the others and is used for rules about people and other external clients. Mirrors the “Subject type” filter of the console.
        
        Default: Any
        
        Allowed values: Any, ServiceAccounts, NonServiceAccounts
      - spec.groups.rules.match.actors
        
        array of strings
        Actors whose events are counted.
        
        Values are matched against actor_id the same way as in excludeActors: * stands for any sequence of characters, everything else is literal.
        
        Use this field to watch a specific subject, for example a ServiceAccount that must not change secrets.
        
        spec.groups.rules.match.actors.Element of the array
        
        string
        
        Maximum length: 253
      - spec.groups.rules.match.categories
        
        array of strings
        Event categories to match, as declared in spec.category of SecurityEventDefinition.
        
        spec.groups.rules.match.categories.Element of the array
        
        string
        
        Allowed values: Auth, Config, Network, Rbac, Runtime
      - spec.groups.rules.match.eventCodes
        
        array of strings
        Event codes to match, as declared in SecurityEventDefinition.
        
        spec.groups.rules.match.eventCodes.Element of the array
        
        string
        For example K8S_SECRET_ACCESSED.
        
        Pattern: ^[A-Z][A-Z0-9_]*$
      - spec.groups.rules.match.excludeActors
        
        array of strings
        Actors whose events the rule ignores.
        
        Values are matched against actor_id: * stands for any sequence of characters, everything else is literal.
        
        Platform components generate most of the routine activity. On an idle cluster, the Deckhouse ServiceAccount alone accounts for thousands of secret reads per hour, so a rule about people and workloads has to exclude them. A typical list:
        
        excludeActors: - "system:serviceaccount:d8-*" - "system:serviceaccount:kube-system:*" - "system:node:*" - "system:apiserver"
        
        spec.groups.rules.match.excludeActors.Element of the array
        
        string
        
        Maximum length: 253
      - spec.groups.rules.match.excludeSystemActors
        
        boolean
        Whether to ignore the events produced by the platform itself.
        
        Routine cluster work touches secrets, RBAC and pods constantly. On an idle cluster, the Deckhouse ServiceAccount alone accounted for 2617 of 2812 secret reads in an hour, which makes a rule about people and workloads statistically insignificant against that background.
        
        The list is maintained by the module and matches the “Exclude system” filter of the console, so the interface and the rule put the same events out of view. The list covers actor_id matching system:serviceaccount:kube-system:*, system:serviceaccount:d8-*, system:node:*, system:kube-*, system:apiserver and kubernetes-admin.
        
        Nothing is removed from the event stream: the events are still collected and delivered, and only stop being counted. Events without an actor are kept, and anonymous or unauthenticated identities are never treated as platform actors, because those are what a security rule looks for.
        
        Default: true
      - spec.groups.rules.match.severityMin
        
        string
        Minimal event severity to match (inclusive).
        
        Allowed values: Low, Medium, High, Critical
      - spec.groups.rules.match.sources
        
        array of strings
        Source components to match, as declared in spec.source of SecurityEventDefinition, for example kube-audit.
        
        spec.groups.rules.match.sources.Element of the array
        
        string
        
        Maximum length: 253
    - spec.groups.rules.mode
      
      string
      Which of the two ways this rule is written in.
      
      Expr — the condition is a LogQL query written by hand in expr. Match — the condition is built from the structured fields of match, optionally counted by aggregation.
      
      The field states explicitly what the presence of expr or match already implies, and must agree with it. It exists so that a reader of the manifest and the platform web interface both know which form a rule is written in without inspecting which block is filled: the web interface shows the fields of the selected mode only, and hides the other form entirely.
      
      Allowed values: Expr, Match
    - spec.groups.rules.severityLevel
      
      integer
      DKP severity level, sent as the severity_level label.
      
      On clusters with update.blockOnAlerts enabled in the deckhouse module, an alert with a level at or below the configured threshold (4 by default) blocks DKP releases from being applied.
      
      Default: 6
      
      Allowed values: 0 <= X <= 9
status

object
Current status of this resource.
- status.conditions
  
  array of objects
  Represents the latest available observations of an object’s state.
  - status.conditions.lastTransitionTime
    
    string
  - status.conditions.message
    
    string
    
    Maximum length: 32768
  - status.conditions.observedGeneration
    
    integer
  - status.conditions.reason
    
    string
    
    Length: 1..1024
  - status.conditions.status
    
    string
    
    Allowed values: True, False, Unknown
  - status.conditions.type
    
    string
    
    Maximum length: 316
- status.observedGeneration
  
  integer
  The generation observed by the controller.

ClusterSecurityEventConfig

Short names: csec

Scope: Cluster
Version: v1alpha1

spec

object
Defines which sources are enabled and which destinations they are shipped to.
- spec.cef
  
  object
  Default CEF (Common Event Format) metadata for destinations that use CEF encoding.
  
  These values are used when a ClusterSecurityEventDestination has encoding.codec set to CEF but does not specify its own cef.deviceVendor, cef.deviceProduct, cef.deviceVersion and cef.version.
  - spec.cef.deviceProduct
    
    string
    Default device product for CEF header.
    
    Applies to a destination that does not set encoding.cef.deviceProduct of its own. When the field is omitted, security-events-manager is used.
    
    Maximum length: 63
  - spec.cef.deviceVendor
    
    string
    Default device vendor for CEF header.
    
    Applies to a destination that does not set encoding.cef.deviceVendor of its own. When the field is omitted, Deckhouse is used.
    
    Maximum length: 63
  - spec.cef.deviceVersion
    
    string
    Default device version for CEF header. This is the fourth field of the CEF header and is unrelated to version, which selects the format of the CEF: prefix.
    
    Applies to a destination that does not set encoding.cef.deviceVersion of its own. When the field is omitted, 1 is used.
    
    Maximum length: 63
  - spec.cef.version
    
    string
    Default CEF format version written in the CEF: prefix of the header.
    
    Applies to a destination that does not set encoding.cef.version of its own. When the field is omitted, V0 is used.
    
    Possible values:
    
    V0 — emit the CEF:0 prefix, used by default and expected by most SIEM systems;
    
    V1 — emit the CEF:1 prefix.
    Allowed values: V0, V1
- spec.defaultSeverityThreshold
  
  string
  Required value
  
  Minimal severity to ship (inclusive).
  
  Allowed values: Low, Medium, High, Critical
- spec.destinations
  
  array of strings
  Required value
  
  List of ClusterSecurityEventDestination names.
  - spec.destinations.Element of the array
    
    string
    
    Maximum length: 253
- spec.enabledSources
  
  array of strings
  Sources that are enabled.
  
  If the parameter is omitted, all sources are enabled. Each item uses one of the following formats:
  - clusterSecurityEventShipper/<SHIPPER NAME>/<SOURCE>;
  - podSecurityEventShipper/<NAMESPACE>/<SHIPPER NAME>/<SOURCE>.
  - spec.enabledSources.Element of the array
    
    string
    
    Pattern: ^(clusterSecurityEventShipper/[^/]+/[^/]+|podSecurityEventShipper/[^/]+/[^/]+/[^/]+)$
- spec.enabledSourcesMasks
  
  array of strings
  Glob masks of the sources that are enabled.
  
  If the parameter is omitted, all sources are enabled. A * in a mask matches any substring, including /. The parameters enabledSources and enabledSourcesMasks are mutually exclusive.
  
  Each mask uses one of the following formats:
  - clusterSecurityEventShipper/<SHIPPER NAME>/<SOURCE>;
  - podSecurityEventShipper/<NAMESPACE>/<SHIPPER NAME>/<SOURCE>.
  For example:
  enabledSourcesMasks: - podSecurityEventShipper/* - clusterSecurityEventShipper/kube-audit/*
  - spec.enabledSourcesMasks.Element of the array
    
    string
    
    Pattern: ^(clusterSecurityEventShipper/.+|podSecurityEventShipper/.+)$
status

object
Current status of this resource.
- status.conditions
  
  array of objects
  Represents the latest available observations of an object’s state.
  - status.conditions.lastTransitionTime
    
    string
  - status.conditions.message
    
    string
    
    Maximum length: 32768
  - status.conditions.observedGeneration
    
    integer
  - status.conditions.reason
    
    string
    
    Length: 1..1024
  - status.conditions.status
    
    string
    
    Allowed values: True, False, Unknown
  - status.conditions.type
    
    string
    
    Maximum length: 316
- status.observedGeneration
  
  integer
  The generation observed by the controller.

ClusterSecurityEventDestination

Short names: csed

Scope: Cluster
Version: v1alpha1

spec

object
Describes where to send security events.

Fields are designed to be translated to deckhouse.io/log-shipper ClusterLogDestination.
- spec.buffer
  
  object
  Per-destination buffer settings for the gateway Vector sink.
  
  Overrides the global gateway.buffer defaults from module values. If not set, the global defaults are used.
  - spec.buffer.maxEvents
    
    integer
    Maximum number of events in the buffer.
    
    Used as a secondary limit for Memory type. Ignored when type=Disk (disk buffer uses maxSize only).
    
    Default: 500
    
    Allowed values: 100 <= X
  - spec.buffer.maxSize
    
    string
    Maximum size of the buffer as a Kubernetes quantity string with a mandatory unit suffix for example 512Mi, 1Gi or 256Mi.
    
    Plain numbers without a unit suffix are not accepted. For Disk: maximum disk space used on the volume. For Memory: approximate memory limit for the in-memory ring buffer.
    
    Default: 512Mi
    
    Pattern: ^[0-9]+(\.[0-9]+)?(Ki|Mi|Gi|Ti|Pi|Ei|k|M|G|T|P|E)$
  - spec.buffer.type
    
    string
    Buffer type.
    
    Possible values:
    
    Disk: disk-based buffer using LevelDB. Survives Vector process restarts within the pod. Used by default and ensures that no security events are lost during a temporary destination outage.
    
    Memory: in-memory ring buffer. Faster, but all events are lost on Vector process restart. Use only for test/dev environments.
    Default: Disk
    
    Allowed values: Memory, Disk
  - spec.buffer.whenFull
    
    string
    Behavior when the buffer is full.
    
    Possible values:
    
    Block: apply backpressure to upstream. The pipeline slows down, but no events are lost. Used by default and is the correct choice for security events.
    
    DropNewest: discard incoming events. Data loss occurs but no backpressure. Use only when data loss is acceptable (test environments).
    Default: Block
    
    Allowed values: Block, DropNewest
- spec.console
  
  object
  - spec.console.encoding
    
    object
    Encoding format for events sent to console.
    
    Default is JSON. Set codec to CEF to emit events in Common Event Format.
    - spec.console.encoding.cef
      
      object
      CEF-specific configuration fields.
      
      Only applicable when codec is set to CEF. Every field of the block is optional and overrides the matching field of spec.cef of ClusterSecurityEventConfig. A field set in neither place falls back to deviceVendor=Deckhouse, deviceProduct=security-events-manager, deviceVersion=1, version=V0.
      - spec.console.encoding.cef.deviceProduct
        
        string
        Device product field in the CEF header.
        
        When the field is omitted, spec.cef.deviceProduct of ClusterSecurityEventConfig applies, and security-events-manager is used when that is not set either.
        
        Maximum length: 63
      - spec.console.encoding.cef.deviceVendor
        
        string
        Device vendor field in the CEF header.
        
        When the field is omitted, spec.cef.deviceVendor of ClusterSecurityEventConfig applies, and Deckhouse is used when that is not set either.
        
        Maximum length: 63
      - spec.console.encoding.cef.deviceVersion
        
        string
        Device version field in the CEF header.
        
        When the field is omitted, spec.cef.deviceVersion of ClusterSecurityEventConfig applies, and 1 is used when that is not set either.
        
        Maximum length: 63
      - spec.console.encoding.cef.version
        
        string
        CEF format version written in the CEF: prefix of the header.
        
        Set it to match the format the receiving SIEM parses. When the field is omitted, spec.cef.version of ClusterSecurityEventConfig applies, and V0 is used when that is not set either.
        
        Possible values:
        
        V0 — emit the CEF:0 prefix, used by default and expected by most SIEM systems;
        
        V1 — emit the CEF:1 prefix.
        
        Allowed values: V0, V1
    - spec.console.encoding.codec
      
      string
      Encoding codec for the destination.
      
      Possible values:
      
      JSON — structured JSON, used by default and suitable for Loki, Elasticsearch and Kafka;
      
      CEF — Common Event Format, suitable for SIEM integration through Kafka, Vector, File, Console and Socket.
      
      Default: JSON
      
      Allowed values: JSON, CEF
    - spec.console.encoding.syslogWrapper
      
      string
      Syslog header wrapping for CEF output.
      
      Only applicable when codec is CEF.
      
      Possible values:
      
      None — emit a bare CEF string, used by default;
      
      RFC3164 — prepend an RFC 3164 (BSD syslog) header;
      
      RFC5424 — prepend an RFC 5424 (IETF syslog) header.
      
      Default: None
      
      Allowed values: None, RFC3164, RFC5424
  - spec.console.target
    
    string
    
    Default: Stdout
    
    Allowed values: Stdout, Stderr
- spec.elasticsearch
  
  object
  - spec.elasticsearch.auth
    
    object
    - spec.elasticsearch.auth.password
      
      string
      Password for Basic authentication.
      
      Consider using passwordSecretRef instead to avoid storing secrets in the resource spec.
      
      Maximum length: 4096
    - spec.elasticsearch.auth.passwordSecretRef
      
      object
      - spec.elasticsearch.auth.passwordSecretRef.name
        
        string
        Required value
        
        Name of the secret in the d8-security-events-manager namespace containing the credential.
        
        The secret must have the key value in its data field.
        
        Maximum length: 253
    - spec.elasticsearch.auth.strategy
      
      string
      
      Default: None
      
      Allowed values: None, Bearer, Basic
    - spec.elasticsearch.auth.token
      
      string
      Bearer token for authentication.
      
      Consider using tokenSecretRef instead to avoid storing secrets in the resource spec.
      
      Maximum length: 4096
    - spec.elasticsearch.auth.tokenSecretRef
      
      object
      - spec.elasticsearch.auth.tokenSecretRef.name
        
        string
        Required value
        
        Name of the secret in the d8-security-events-manager namespace containing the credential.
        
        The secret must have the key value in its data field.
        
        Maximum length: 253
    - spec.elasticsearch.auth.username
      
      string
      
      Maximum length: 4096
  - spec.elasticsearch.endpoint
    
    string
    Required value
    
    Maximum length: 2048
  - spec.elasticsearch.index
    
    string
    
    Maximum length: 253
  - spec.elasticsearch.tls
    
    object
    - spec.elasticsearch.tls.ca
      
      string
      Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      
      Maximum length: 32768
    - spec.elasticsearch.tls.verifyCertificate
      
      boolean
      
      Default: true
    - spec.elasticsearch.tls.verifyHostname
      
      boolean
      
      Default: true
- spec.file
  
  object
  - spec.file.encoding
    
    object
    Encoding format for events written to this file destination.
    
    Default is JSON. Set codec to CEF to write events in Common Event Format.
    - spec.file.encoding.cef
      
      object
      CEF-specific configuration fields.
      
      Only applicable when codec is set to CEF. Every field of the block is optional and overrides the matching field of spec.cef of ClusterSecurityEventConfig. A field set in neither place falls back to deviceVendor=Deckhouse, deviceProduct=security-events-manager, deviceVersion=1, version=V0.
      - spec.file.encoding.cef.deviceProduct
        
        string
        Device product field in the CEF header.
        
        When the field is omitted, spec.cef.deviceProduct of ClusterSecurityEventConfig applies, and security-events-manager is used when that is not set either.
        
        Maximum length: 63
      - spec.file.encoding.cef.deviceVendor
        
        string
        Device vendor field in the CEF header.
        
        When the field is omitted, spec.cef.deviceVendor of ClusterSecurityEventConfig applies, and Deckhouse is used when that is not set either.
        
        Maximum length: 63
      - spec.file.encoding.cef.deviceVersion
        
        string
        Device version field in the CEF header.
        
        When the field is omitted, spec.cef.deviceVersion of ClusterSecurityEventConfig applies, and 1 is used when that is not set either.
        
        Maximum length: 63
      - spec.file.encoding.cef.version
        
        string
        CEF format version written in the CEF: prefix of the header.
        
        Set it to match the format the receiving SIEM parses. When the field is omitted, spec.cef.version of ClusterSecurityEventConfig applies, and V0 is used when that is not set either.
        
        Possible values:
        
        V0 — emit the CEF:0 prefix, used by default and expected by most SIEM systems;
        
        V1 — emit the CEF:1 prefix.
        
        Allowed values: V0, V1
    - spec.file.encoding.codec
      
      string
      Encoding codec for the destination.
      
      Possible values:
      
      JSON — structured JSON, used by default and suitable for Loki, Elasticsearch and Kafka;
      
      CEF — Common Event Format, suitable for SIEM integration through Kafka, Vector, File, Console and Socket.
      
      Default: JSON
      
      Allowed values: JSON, CEF
    - spec.file.encoding.syslogWrapper
      
      string
      Syslog header wrapping for CEF output.
      
      Only applicable when codec is CEF.
      
      Possible values:
      
      None — emit a bare CEF string, used by default;
      
      RFC3164 — prepend an RFC 3164 (BSD syslog) header;
      
      RFC5424 — prepend an RFC 5424 (IETF syslog) header.
      
      Default: None
      
      Allowed values: None, RFC3164, RFC5424
  - spec.file.path
    
    string
    Required value
    
    Maximum length: 2048
- spec.http
  
  object
  - spec.http.auth
    
    object
    - spec.http.auth.password
      
      string
      Password for Basic authentication.
      
      Consider using passwordSecretRef instead to avoid storing secrets in the resource spec.
      
      Maximum length: 4096
    - spec.http.auth.passwordSecretRef
      
      object
      - spec.http.auth.passwordSecretRef.name
        
        string
        Required value
        
        Name of the secret in the d8-security-events-manager namespace containing the credential.
        
        The secret must have the key value in its data field.
        
        Maximum length: 253
    - spec.http.auth.strategy
      
      string
      
      Default: None
      
      Allowed values: None, Bearer, Basic
    - spec.http.auth.token
      
      string
      Bearer token for authentication.
      
      Consider using tokenSecretRef instead to avoid storing secrets in the resource spec.
      
      Maximum length: 4096
    - spec.http.auth.tokenSecretRef
      
      object
      - spec.http.auth.tokenSecretRef.name
        
        string
        Required value
        
        Name of the secret in the d8-security-events-manager namespace containing the credential.
        
        The secret must have the key value in its data field.
        
        Maximum length: 253
    - spec.http.auth.username
      
      string
      
      Maximum length: 4096
  - spec.http.endpoint
    
    string
    Required value
    
    Full URL to send events to, including the path, for example https://collector.example.com/api/ingest.
    
    Events are always sent with the POST method.
    
    Maximum length: 2048
  - spec.http.framing
    
    string
    How a set of events is laid out in the request body.
    
    JSONArray wraps the set into a single JSON array, which is what receivers expecting one document per request read. NewlineDelimited sends one JSON object per line (NDJSON), which suits collectors that read a stream of records.
    
    Default: JSONArray
    
    Allowed values: JSONArray, NewlineDelimited
  - spec.http.headers
    
    object
    Additional request headers.
    
    The Authorization header is managed by auth and must not be set here.
    
    Header values are treated as secrets: a receiver often expects its API key in a header of its own. Values are hidden the same way auth.token is, so read them back through the clustersecurityeventdestinations/sensitive subresource.
  - spec.http.tls
    
    object
    - spec.http.tls.ca
      
      string
      Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      
      Maximum length: 32768
    - spec.http.tls.verifyCertificate
      
      boolean
      
      Default: true
    - spec.http.tls.verifyHostname
      
      boolean
      
      Default: true
- spec.kafka
  
  object
  - spec.kafka.brokers
    
    array of strings
    Required value
    - spec.kafka.brokers.Element of the array
      
      string
      
      Maximum length: 259
  - spec.kafka.encoding
    
    object
    Encoding format for events sent to this Kafka destination.
    
    Default is JSON. Set codec to CEF to emit events in Common Event Format (requires a CEF-capable SIEM consumer on the receiving end).
    - spec.kafka.encoding.cef
      
      object
      CEF-specific configuration fields.
      
      Only applicable when codec is set to CEF. Every field of the block is optional and overrides the matching field of spec.cef of ClusterSecurityEventConfig. A field set in neither place falls back to deviceVendor=Deckhouse, deviceProduct=security-events-manager, deviceVersion=1, version=V0.
      - spec.kafka.encoding.cef.deviceProduct
        
        string
        Device product field in the CEF header.
        
        When the field is omitted, spec.cef.deviceProduct of ClusterSecurityEventConfig applies, and security-events-manager is used when that is not set either.
        
        Maximum length: 63
      - spec.kafka.encoding.cef.deviceVendor
        
        string
        Device vendor field in the CEF header.
        
        When the field is omitted, spec.cef.deviceVendor of ClusterSecurityEventConfig applies, and Deckhouse is used when that is not set either.
        
        Maximum length: 63
      - spec.kafka.encoding.cef.deviceVersion
        
        string
        Device version field in the CEF header.
        
        When the field is omitted, spec.cef.deviceVersion of ClusterSecurityEventConfig applies, and 1 is used when that is not set either.
        
        Maximum length: 63
      - spec.kafka.encoding.cef.version
        
        string
        CEF format version written in the CEF: prefix of the header.
        
        Set it to match the format the receiving SIEM parses. When the field is omitted, spec.cef.version of ClusterSecurityEventConfig applies, and V0 is used when that is not set either.
        
        Possible values:
        
        V0 — emit the CEF:0 prefix, used by default and expected by most SIEM systems;
        
        V1 — emit the CEF:1 prefix.
        
        Allowed values: V0, V1
    - spec.kafka.encoding.codec
      
      string
      Encoding codec for the destination.
      
      Possible values:
      
      JSON — structured JSON, used by default and suitable for Loki, Elasticsearch and Kafka;
      
      CEF — Common Event Format, suitable for SIEM integration through Kafka, Vector, File, Console and Socket.
      
      Default: JSON
      
      Allowed values: JSON, CEF
    - spec.kafka.encoding.syslogWrapper
      
      string
      Syslog header wrapping for CEF output.
      
      Only applicable when codec is CEF.
      
      Possible values:
      
      None — emit a bare CEF string, used by default;
      
      RFC3164 — prepend an RFC 3164 (BSD syslog) header;
      
      RFC5424 — prepend an RFC 5424 (IETF syslog) header.
      
      Default: None
      
      Allowed values: None, RFC3164, RFC5424
  - spec.kafka.sasl
    
    object
    - spec.kafka.sasl.mechanism
      
      string
      
      Allowed values: Plain, SCRAM-SHA-256, SCRAM-SHA-512
    - spec.kafka.sasl.password
      
      string
      SASL password.
      
      Consider using passwordSecretRef instead to avoid storing secrets in the resource spec.
      
      Maximum length: 4096
    - spec.kafka.sasl.passwordSecretRef
      
      object
      - spec.kafka.sasl.passwordSecretRef.name
        
        string
        Required value
        
        Name of the secret in the d8-security-events-manager namespace containing the credential.
        
        The secret must have the key value in its data field.
        
        Maximum length: 253
    - spec.kafka.sasl.username
      
      string
      
      Maximum length: 4096
  - spec.kafka.tls
    
    object
    - spec.kafka.tls.ca
      
      string
      Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      
      Maximum length: 32768
    - spec.kafka.tls.verifyCertificate
      
      boolean
      
      Default: true
    - spec.kafka.tls.verifyHostname
      
      boolean
      
      Default: true
  - spec.kafka.topic
    
    string
    Required value
    
    Maximum length: 249
- spec.loki
  
  object
  - spec.loki.auth
    
    object
    - spec.loki.auth.password
      
      string
      Password for Basic authentication.
      
      Consider using passwordSecretRef instead to avoid storing secrets in the resource spec.
      
      Maximum length: 4096
    - spec.loki.auth.passwordSecretRef
      
      object
      - spec.loki.auth.passwordSecretRef.name
        
        string
        Required value
        
        Name of the secret in the d8-security-events-manager namespace containing the credential.
        
        The secret must have the key value in its data field.
        
        Maximum length: 253
    - spec.loki.auth.strategy
      
      string
      
      Default: None
      
      Allowed values: None, Bearer, Basic
    - spec.loki.auth.token
      
      string
      Bearer token for authentication.
      
      Consider using tokenSecretRef instead to avoid storing secrets in the resource spec.
      
      Maximum length: 4096
    - spec.loki.auth.tokenSecretRef
      
      object
      - spec.loki.auth.tokenSecretRef.name
        
        string
        Required value
        
        Name of the secret in the d8-security-events-manager namespace containing the credential.
        
        The secret must have the key value in its data field.
        
        Maximum length: 253
    - spec.loki.auth.username
      
      string
      
      Maximum length: 4096
  - spec.loki.endpoint
    
    string
    Required value
    
    Maximum length: 2048
  - spec.loki.tls
    
    object
    - spec.loki.tls.ca
      
      string
      Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      
      Maximum length: 32768
    - spec.loki.tls.verifyCertificate
      
      boolean
      
      Default: true
    - spec.loki.tls.verifyHostname
      
      boolean
      
      Default: true
- spec.socket
  
  object
  - spec.socket.address
    
    string
    Required value
    The address to connect to.
    
    Format depends on mode:
    
    TCP — host:port, for example siem.example.com:514;
    
    UDP — host:port, for example siem.example.com:514;
    
    Unix — /path/to/socket, for example /var/run/siem.sock.
    Maximum length: 2048
  - spec.socket.encoding
    
    object
    Encoding format for events sent to this socket destination.
    
    Default is JSON. Set codec to CEF to emit events in Common Event Format (the primary use-case for syslog-based SIEM integrations).
    - spec.socket.encoding.cef
      
      object
      CEF-specific configuration fields.
      
      Only applicable when codec is set to CEF. Every field of the block is optional and overrides the matching field of spec.cef of ClusterSecurityEventConfig. A field set in neither place falls back to deviceVendor=Deckhouse, deviceProduct=security-events-manager, deviceVersion=1, version=V0.
      - spec.socket.encoding.cef.deviceProduct
        
        string
        Device product field in the CEF header.
        
        When the field is omitted, spec.cef.deviceProduct of ClusterSecurityEventConfig applies, and security-events-manager is used when that is not set either.
        
        Maximum length: 63
      - spec.socket.encoding.cef.deviceVendor
        
        string
        Device vendor field in the CEF header.
        
        When the field is omitted, spec.cef.deviceVendor of ClusterSecurityEventConfig applies, and Deckhouse is used when that is not set either.
        
        Maximum length: 63
      - spec.socket.encoding.cef.deviceVersion
        
        string
        Device version field in the CEF header.
        
        When the field is omitted, spec.cef.deviceVersion of ClusterSecurityEventConfig applies, and 1 is used when that is not set either.
        
        Maximum length: 63
      - spec.socket.encoding.cef.version
        
        string
        CEF format version written in the CEF: prefix of the header.
        
        Set it to match the format the receiving SIEM parses. When the field is omitted, spec.cef.version of ClusterSecurityEventConfig applies, and V0 is used when that is not set either.
        
        Possible values:
        
        V0 — emit the CEF:0 prefix, used by default and expected by most SIEM systems;
        
        V1 — emit the CEF:1 prefix.
        
        Allowed values: V0, V1
    - spec.socket.encoding.codec
      
      string
      Encoding codec for the destination.
      
      Possible values:
      
      JSON — structured JSON, used by default and suitable for Loki, Elasticsearch and Kafka;
      
      CEF — Common Event Format, suitable for SIEM integration through Kafka, Vector, File, Console and Socket.
      
      Default: JSON
      
      Allowed values: JSON, CEF
    - spec.socket.encoding.syslogWrapper
      
      string
      Syslog header wrapping for CEF output.
      
      Only applicable when codec is CEF.
      
      Possible values:
      
      None — emit a bare CEF string, used by default;
      
      RFC3164 — prepend an RFC 3164 (BSD syslog) header;
      
      RFC5424 — prepend an RFC 5424 (IETF syslog) header.
      
      Default: None
      
      Allowed values: None, RFC3164, RFC5424
  - spec.socket.mode
    
    string
    Required value
    Socket transport mode.
    
    Possible values:
    
    TCP — stream-oriented and reliable, supports TLS. Recommended for a production syslog;
    
    UDP — datagram-oriented, with no delivery guarantee. The maximum message size is limited by the MTU;
    
    Unix — local Unix domain socket in stream mode. Intended for SIEM agents running as a sidecar.
    Allowed values: TCP, UDP, Unix
  - spec.socket.tls
    
    object
    TLS configuration.
    
    Only applicable when mode is TCP. Ignored for UDP and Unix modes.
    - spec.socket.tls.ca
      
      string
      Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      
      Maximum length: 32768
    - spec.socket.tls.verifyCertificate
      
      boolean
      
      Default: true
    - spec.socket.tls.verifyHostname
      
      boolean
      
      Default: true
- spec.splunkHEC
  
  object
  - spec.splunkHEC.endpoint
    
    string
    Required value
    
    Maximum length: 2048
  - spec.splunkHEC.tls
    
    object
    - spec.splunkHEC.tls.ca
      
      string
      Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      
      Maximum length: 32768
    - spec.splunkHEC.tls.verifyCertificate
      
      boolean
      
      Default: true
    - spec.splunkHEC.tls.verifyHostname
      
      boolean
      
      Default: true
  - spec.splunkHEC.token
    
    string
    Splunk HEC token.
    
    Consider using tokenSecretRef instead to avoid storing secrets in the resource spec.
    
    Maximum length: 4096
  - spec.splunkHEC.tokenSecretRef
    
    object
    - spec.splunkHEC.tokenSecretRef.name
      
      string
      Required value
      
      Name of the secret in the d8-security-events-manager namespace containing the credential.
      
      The secret must have the key value in its data field.
      
      Maximum length: 253
- spec.type
  
  string
  Required value
  
  Allowed values: Loki, Elasticsearch, Kafka, SplunkHEC, File, Console, Vector, Socket, Http
- spec.vector
  
  object
  - spec.vector.encoding
    
    object
    Encoding format for events sent to this Vector destination.
    
    Default is JSON. Set codec to CEF to emit events in Common Event Format.
    - spec.vector.encoding.cef
      
      object
      CEF-specific configuration fields.
      
      Only applicable when codec is set to CEF. Every field of the block is optional and overrides the matching field of spec.cef of ClusterSecurityEventConfig. A field set in neither place falls back to deviceVendor=Deckhouse, deviceProduct=security-events-manager, deviceVersion=1, version=V0.
      - spec.vector.encoding.cef.deviceProduct
        
        string
        Device product field in the CEF header.
        
        When the field is omitted, spec.cef.deviceProduct of ClusterSecurityEventConfig applies, and security-events-manager is used when that is not set either.
        
        Maximum length: 63
      - spec.vector.encoding.cef.deviceVendor
        
        string
        Device vendor field in the CEF header.
        
        When the field is omitted, spec.cef.deviceVendor of ClusterSecurityEventConfig applies, and Deckhouse is used when that is not set either.
        
        Maximum length: 63
      - spec.vector.encoding.cef.deviceVersion
        
        string
        Device version field in the CEF header.
        
        When the field is omitted, spec.cef.deviceVersion of ClusterSecurityEventConfig applies, and 1 is used when that is not set either.
        
        Maximum length: 63
      - spec.vector.encoding.cef.version
        
        string
        CEF format version written in the CEF: prefix of the header.
        
        Set it to match the format the receiving SIEM parses. When the field is omitted, spec.cef.version of ClusterSecurityEventConfig applies, and V0 is used when that is not set either.
        
        Possible values:
        
        V0 — emit the CEF:0 prefix, used by default and expected by most SIEM systems;
        
        V1 — emit the CEF:1 prefix.
        
        Allowed values: V0, V1
    - spec.vector.encoding.codec
      
      string
      Encoding codec for the destination.
      
      Possible values:
      
      JSON — structured JSON, used by default and suitable for Loki, Elasticsearch and Kafka;
      
      CEF — Common Event Format, suitable for SIEM integration through Kafka, Vector, File, Console and Socket.
      
      Default: JSON
      
      Allowed values: JSON, CEF
    - spec.vector.encoding.syslogWrapper
      
      string
      Syslog header wrapping for CEF output.
      
      Only applicable when codec is CEF.
      
      Possible values:
      
      None — emit a bare CEF string, used by default;
      
      RFC3164 — prepend an RFC 3164 (BSD syslog) header;
      
      RFC5424 — prepend an RFC 5424 (IETF syslog) header.
      
      Default: None
      
      Allowed values: None, RFC3164, RFC5424
  - spec.vector.endpoint
    
    string
    Required value
    
    Maximum length: 2048
  - spec.vector.tls
    
    object
    - spec.vector.tls.ca
      
      string
      Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      
      Maximum length: 32768
    - spec.vector.tls.verifyCertificate
      
      boolean
      
      Default: true
    - spec.vector.tls.verifyHostname
      
      boolean
      
      Default: true

ClusterSecurityEventEnrichmentPlugin

Short names: csep

Scope: Cluster
Version: v1alpha1

spec

object
Describes an enrichment plugin — an HTTP endpoint that resolves additional fields for outgoing SecurityEvents at runtime.
- Internal plugins are served by the built-in enrichment-cache sidecar in the gateway pod. The module ships three Internal plugins: k8s-pod-info, k8s-container-info, k8s-nodeuser-info. Internal resources are managed by Deckhouse and cannot be created or modified.
- External plugins are served by user-deployed pods in any namespace. The resource specifies the endpoint URL, the argument schema, the return field schema and, optionally, TLS and authentication settings.
- spec.args
  
  array of objects
  Required value
  
  Input arguments, passed as query parameters, that the plugin accepts.
  
  Each argument has a name, a flag marking it as required, and a description.
  
  When a ShipperEnrichRule references this plugin, its args values are resolved from event fields (dot-paths) and sent as query parameters to the plugin endpoint.
  
  The controller validates that all required: true args are present in the referencing ShipperEnrichRule.
  - spec.args.description
    
    string
    Human-readable description of the argument.
    
    Maximum length: 4096
  - spec.args.name
    
    string
    Argument name, used as the query parameter key.
    
    Length: 1..253
  - spec.args.required
    
    boolean
    Whether the argument is required in ShipperEnrichRule.
    
    Default: true
- spec.description
  
  string
  Human-readable description of the plugin.
  
  Maximum length: 4096
- spec.endpoint
  
  object
  HTTP endpoint configuration.
  
  Required for External plugins. For Internal plugins the parameter is ignored, because the sidecar URL is used automatically.
  - spec.endpoint.headers
    
    array of objects
    Static HTTP headers sent with each lookup request.
    - spec.endpoint.headers.name
      
      string
      
      Length: 1..256
    - spec.endpoint.headers.value
      
      string
      
      Maximum length: 4096
  - spec.endpoint.tls
    
    object
    TLS configuration for the HTTPS endpoint.
    - spec.endpoint.tls.caSecret
      
      string
      Name of a Secret in the module namespace (d8-security-events-manager) containing the CA certificate (key ca.crt). Used to verify the plugin endpoint’s TLS certificate.
      
      Maximum length: 253
    - spec.endpoint.tls.clientCertSecret
      
      string
      Name of a Secret in the module namespace containing the client certificate and key for mTLS (keys tls.crt, tls.key).
      
      Maximum length: 253
  - spec.endpoint.url
    
    string
    Required value
    
    Full HTTP(S) URL of the enrichment endpoint.
    
    The controller generates a request of the form GET <URL>?<ARGS AS QUERY PARAMS>. The URL must start with http:// or https://. To prevent SSRF, it must not reference cloud metadata endpoints such as 169.254.x.x or link-local addresses.
    
    Length: 1..2048
- spec.readiness
  
  object
  Readiness probe of the plugin.
  
  The controller can probe this endpoint before including the plugin in the gateway configuration. If the endpoint is unreachable, the controller sets the NotReady status condition.
  - spec.readiness.expectedStatus
    
    integer
    Expected HTTP status code for a ready plugin.
    
    Default: 200
  - spec.readiness.path
    
    string
    HTTP path to probe, appended to endpoint.url.
    
    Default: /healthz
    
    Maximum length: 2048
- spec.returns
  
  object
  Required value
  
  Fields that the plugin returns in its JSON response.
  
  The list is used for validation: the value parameter in a referencing ShipperEnrichRule must match one of the fields[].name values listed here.
  - spec.returns.fields
    
    array of objects
    Required value
    - spec.returns.fields.description
      
      string
      Human-readable description of the field.
      
      Maximum length: 4096
    - spec.returns.fields.name
      
      string
      Response field name.
      
      Length: 1..253
    - spec.returns.fields.type
      
      string
      Field type.
      
      Allowed values: String, Int, Bool
- spec.type
  
  string
  Required value
  Plugin type.
  - Internal — served by the built-in enrichment-cache sidecar, no endpoint required;
  - External — served by a user-deployed pod, requires endpoint.url.
  Allowed values: Internal, External
status

object
Current status of this resource.
- status.conditions
  
  array of objects
  Represents the latest available observations of an object’s state.
  - status.conditions.lastTransitionTime
    
    string
  - status.conditions.message
    
    string
    
    Maximum length: 32768
  - status.conditions.observedGeneration
    
    integer
  - status.conditions.reason
    
    string
    
    Length: 1..1024
  - status.conditions.status
    
    string
    
    Allowed values: True, False, Unknown
  - status.conditions.type
    
    string
    
    Maximum length: 316
- status.observedGeneration
  
  integer
  The generation observed by the controller.

ClusterSecurityEventLoggingTransformationRules

Short names: cseltr

Scope: Cluster
Version: v1alpha1

spec

object
Cluster-wide rules to transform raw log lines into structured objects (Vector events) before further processing.

Namespaced SecurityEventLoggingTransformationRules (SELTR) take precedence over these rules when both match the same pod/container.
- spec.file
  
  object
  Selection + shared transform for node file logs. Required when type is File.
  
  File match is performed against the Vector event field .file.
  - spec.file.paths
    
    array of strings
    Required value
    
    Exact file paths to match.
    - spec.file.paths.Element of the array
      
      string
      
      Length: 1..4096
  - spec.file.transform
    
    object
    Required value
    
    Shared transformation applied to every matched file log line.
    - spec.file.transform.drop_raw
      
      boolean
      
      Default: false
    - spec.file.transform.fields
      
      array of objects
      - spec.file.transform.fields.name
        
        string
        Field name in the parsed object.
        
        Length: 1..253
      - spec.file.transform.fields.type
        
        string
        Target field type.
        
        Allowed values: String, Int, Float, Bool
    - spec.file.transform.parser
      
      object
      Required value
      
      Parser configuration that defines how to unpack the original log line.
      
      Parsing follows these rules:
      
      parsing is best-effort, so errors and mismatches do not drop events;
      
      for the Regex and Grok types, the first successfully matched pattern wins;
      
      named captures are written into .parsed_data.
      - spec.file.transform.parser.grok
        
        object
        Grok parser configuration. Named fields are saved into .parsed_data.
        
        spec.file.transform.parser.grok.customPatterns
        
        array of objects
        Custom grok pattern definitions (name -> regex). These are added to the built-in grok patterns.
        
        spec.file.transform.parser.grok.customPatterns.key
        
        string
        
        Maximum length: 256
        
        spec.file.transform.parser.grok.customPatterns.value
        
        string
        
        Maximum length: 4096
        
        spec.file.transform.parser.grok.patterns
        
        array of strings
        Required value
        
        Grok patterns to try in order. The first successfully matched pattern wins.
        
        spec.file.transform.parser.grok.patterns.Element of the array
        
        string
        
        Length: 1..16384
      - spec.file.transform.parser.regex
        
        object
        Regex parser configuration. Only named capture groups are saved into .parsed_data.
        
        spec.file.transform.parser.regex.patterns
        
        array of strings
        Required value
        
        Regex patterns to try in order. The first successfully matched pattern wins.
        
        spec.file.transform.parser.regex.patterns.Element of the array
        
        string
        
        Length: 1..16384
      - spec.file.transform.parser.type
        
        string
        Required value
        
        Parser type.
        
        JSON — parse the original log line as JSON with parse_json();
        
        Regex — apply regular expressions and extract named capture groups;
        
        Grok — apply grok patterns and extract named fields.
        
        Allowed values: JSON, Regex, Grok
- spec.kubernetesPods
  
  object
  Selection + per-container transforms for Kubernetes pod logs. Required when type is KubernetesPods.
  - spec.kubernetesPods.containers
    
    array of objects
    Required value
    
    Per-container transformation rules.
    - spec.kubernetesPods.containers.drop_raw
      
      boolean
      If true, removes the original raw message field after parsing.
      
      Default: false
    - spec.kubernetesPods.containers.fields
      
      array of objects
      Field type conversions applied after parsing. Use them to enforce stable types for sinks such as Elasticsearch or ClickHouse.
      - spec.kubernetesPods.containers.fields.name
        
        string
        Field name in the parsed object.
        
        Length: 1..253
      - spec.kubernetesPods.containers.fields.type
        
        string
        Target field type.
        
        Allowed values: String, Int, Float, Bool
    - spec.kubernetesPods.containers.name
      
      string
      Container name to apply this transformation to.
      
      Length: 1..253
    - spec.kubernetesPods.containers.parser
      
      object
      Parser configuration that defines how to unpack the original log line.
      
      Parsing follows these rules:
      
      parsing is best-effort, so errors and mismatches do not drop events;
      
      for the Regex and Grok types, the first successfully matched pattern wins;
      
      named captures are written into .parsed_data.
      - spec.kubernetesPods.containers.parser.grok
        
        object
        Grok parser configuration. Named fields are saved into .parsed_data.
        
        spec.kubernetesPods.containers.parser.grok.customPatterns
        
        array of objects
        Custom grok pattern definitions (name -> regex). These are added to the built-in grok patterns.
        
        spec.kubernetesPods.containers.parser.grok.customPatterns.key
        
        string
        
        Maximum length: 256
        
        spec.kubernetesPods.containers.parser.grok.customPatterns.value
        
        string
        
        Maximum length: 4096
        
        spec.kubernetesPods.containers.parser.grok.patterns
        
        array of strings
        Required value
        
        Grok patterns to try in order. The first successfully matched pattern wins.
        
        spec.kubernetesPods.containers.parser.grok.patterns.Element of the array
        
        string
        
        Length: 1..16384
      - spec.kubernetesPods.containers.parser.regex
        
        object
        Regex parser configuration. Only named capture groups are saved into .parsed_data.
        
        spec.kubernetesPods.containers.parser.regex.patterns
        
        array of strings
        Required value
        
        Regex patterns to try in order. The first successfully matched pattern wins.
        
        spec.kubernetesPods.containers.parser.regex.patterns.Element of the array
        
        string
        
        Length: 1..16384
      - spec.kubernetesPods.containers.parser.type
        
        string
        Required value
        
        Parser type.
        
        JSON — parse the original log line as JSON with parse_json();
        
        Regex — apply regular expressions and extract named capture groups;
        
        Grok — apply grok patterns and extract named fields.
        
        Allowed values: JSON, Regex, Grok
  - spec.kubernetesPods.labelSelector
    
    object
    Required value
    
    Pod label selector.
    
    Not used for matching. Pods are selected by the shipper that references these rules, through its own input.kubernetesPods.labelSelector. The field is kept required for compatibility and is ignored.
    - spec.kubernetesPods.labelSelector.matchExpressions
      
      array of objects
      List of label selector requirements.
      - spec.kubernetesPods.labelSelector.matchExpressions.key
        
        string
        
        Maximum length: 317
      - spec.kubernetesPods.labelSelector.matchExpressions.operator
        
        string
        
        Allowed values: In, NotIn, Exists, DoesNotExist
      - spec.kubernetesPods.labelSelector.matchExpressions.values
        
        array of strings
        
        spec.kubernetesPods.labelSelector.matchExpressions.values.Element of the array
        
        string
        
        Maximum length: 63
    - spec.kubernetesPods.labelSelector.matchLabels
      
      object
      Map of label key to value.
  - spec.kubernetesPods.namespaceSelector
    
    object
    Namespace selection (subset of ClusterLoggingConfig). Only matchNames/excludeNames are supported.
    
    Not used for matching. Namespaces are selected by the shipper that references these rules, through its own input.kubernetesPods. The field is ignored.
    - spec.kubernetesPods.namespaceSelector.excludeNames
      
      array of strings
      - spec.kubernetesPods.namespaceSelector.excludeNames.Element of the array
        
        string
        
        Maximum length: 253
    - spec.kubernetesPods.namespaceSelector.matchNames
      
      array of strings
      - spec.kubernetesPods.namespaceSelector.matchNames.Element of the array
        
        string
        
        Maximum length: 253
- spec.type
  
  string
  Required value
  
  Input type the rules apply to. KubernetesPods — match pod/container logs. File — match node file logs.
  
  Allowed values: KubernetesPods, File
status

object
Current status of this resource.
- status.conditions
  
  array of objects
  Represents the latest available observations of an object’s state.
  - status.conditions.lastTransitionTime
    
    string
  - status.conditions.message
    
    string
    
    Maximum length: 32768
  - status.conditions.observedGeneration
    
    integer
  - status.conditions.reason
    
    string
    
    Length: 1..1024
  - status.conditions.status
    
    string
    
    Allowed values: True, False, Unknown
  - status.conditions.type
    
    string
    
    Maximum length: 316
- status.observedGeneration
  
  integer
  The generation observed by the controller.

ClusterSecurityEventShipper

Short names: cses

Scope: Cluster
Version: v1alpha1

spec

array of objects
Cluster-wide pipelines for extracting security events from node files or pod logs. Each pipeline item describes the source and one or more event definitions (produces).
- spec.input
  
  object
  - spec.input.files
    
    array of strings
    Node file paths (required for type File).
    - spec.input.files.Element of the array
      
      string
      
      Maximum length: 4096
  - spec.input.kubernetesPods
    
    object
    Pod selection for cluster-wide collection.
    - spec.input.kubernetesPods.labelSelector
      
      object
      Required value
      
      Kubernetes-style label selector.
      - spec.input.kubernetesPods.labelSelector.matchExpressions
        
        array of objects
        List of label selector requirements.
        
        spec.input.kubernetesPods.labelSelector.matchExpressions.key
        
        string
        
        Length: 1..317
        
        spec.input.kubernetesPods.labelSelector.matchExpressions.operator
        
        string
        
        Allowed values: In, NotIn, Exists, DoesNotExist
        
        spec.input.kubernetesPods.labelSelector.matchExpressions.values
        
        array of strings
        
        spec.input.kubernetesPods.labelSelector.matchExpressions.values.Element of the array
        
        string
        
        Maximum length: 63
      - spec.input.kubernetesPods.labelSelector.matchLabels
        
        object
        Map of label key to value.
    - spec.input.kubernetesPods.namespace
      
      string
      Namespace to collect pod logs from (legacy exact namespace match).
      
      Length: 1..63
      
      Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
    - spec.input.kubernetesPods.namespaceSelector
      
      object
      Namespace selector for cluster pod log collection.
      
      If matchNames is set, only these namespaces are included.
      
      If excludeNames is set, these namespaces are excluded.
      
      If both are set, the exclusion applies on top of the inclusion.
      
      If both are empty, all namespaces are matched.
      
      The selector is translated into a condition on the kubernetes.io/metadata.name label of a namespace.
      - spec.input.kubernetesPods.namespaceSelector.excludeNames
        
        array of strings
        Explicitly excluded namespace names.
        
        spec.input.kubernetesPods.namespaceSelector.excludeNames.Element of the array
        
        string
        
        Length: 1..63
        
        Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
      - spec.input.kubernetesPods.namespaceSelector.matchNames
        
        array of strings
        Explicitly included namespace names.
        
        spec.input.kubernetesPods.namespaceSelector.matchNames.Element of the array
        
        string
        
        Length: 1..63
        
        Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
  - spec.input.type
    
    string
    Required value
    
    File — read from node files. KubernetesPods — read from pod logs (cluster-wide; labelSelector required; namespace or namespaceSelector optional).
    
    Allowed values: File, KubernetesPods
- spec.parser
  
  array of objects
  Parser rules for best-effort parsing of raw log line .message into .parsed_data.
  - For input.type: KubernetesPods: this repeats SecurityEventLoggingTransformationRules.spec.containers[]. Match is performed by .namespace + .container + .pod_labels.
  - For input.type: File: set name: file and the rule will be applied when .file matches one of input.files.
  Container selection happens on the log-shipper side via labelFilter.
  - spec.parser.drop_raw
    
    boolean
    If true, removes the original raw message field after parsing.
    
    Default: false
  - spec.parser.fields
    
    array of objects
    Field type conversions applied after parsing.
    - spec.parser.fields.name
      
      string
      Field name in the parsed object.
      
      Length: 1..253
    - spec.parser.fields.type
      
      string
      Target field type.
      
      Allowed values: String, Int, Float, Bool
  - spec.parser.name
    
    string
    Container name (or file for file input).
    
    Length: 1..253
  - spec.parser.parser
    
    object
    Parser configuration.
    - spec.parser.parser.grok
      
      object
      - spec.parser.parser.grok.customPatterns
        
        array of objects
        
        spec.parser.parser.grok.customPatterns.key
        
        string
        
        Maximum length: 256
        
        spec.parser.parser.grok.customPatterns.value
        
        string
        
        Maximum length: 4096
      - spec.parser.parser.grok.patterns
        
        array of strings
        Required value
        
        spec.parser.parser.grok.patterns.Element of the array
        
        string
        
        Length: 1..16384
    - spec.parser.parser.regex
      
      object
      - spec.parser.parser.regex.patterns
        
        array of strings
        Required value
        
        spec.parser.parser.regex.patterns.Element of the array
        
        string
        
        Length: 1..16384
    - spec.parser.parser.type
      
      string
      Required value
      
      Parser type.
      
      Allowed values: JSON, Regex, Grok
- spec.parserRef
  
  string
  Name of ClusterSecurityEventLoggingTransformationRules (CSELTR) object to use as parser rule source.
  
  Used only when parser is not set.
  
  Length: 1..253
- spec.produces
  
  array of objects
  List of produced security events for this source.
  - spec.produces.enrich
    
    array of objects
    Enrichment rules for adding extra fields into outgoing SecurityEvent.
    
    Each rule writes into a destination field path (target). Sources:
    
    Static: write a literal string from value.
    
    Plugin: resolve a field at runtime via HTTP lookup to the enrichment-cache sidecar (in-memory Pod/NodeUser cache, no API server call per event). Plugins:
    
    k8s-pod-info, k8s-container-info: resolve Pod fields. Supports two lookup modes:
    
    Pod-name mode: args pod_name + namespace.
    
    Container-ID mode: arg container_id (resolves namespace, name, or serviceAccountName from the container runtime ID).
    
    k8s-nodeuser-info: resolve a static-user username (nodeusers.deckhouse.io) by uid. Arg uid (resolves the NodeUser metadata.name matching spec.uid).
    
    Enrich rules are applied after transform, so they override transform when targeting the same field.
    - spec.produces.enrich.args
      
      array of objects
      Plugin arguments as key/value pairs. The key must match an arg name declared by the referenced ClusterSecurityEventEnrichmentPlugin CR (spec.args[].name). The value is a dot-path in the event resolved with the same logic as transform rules: a @root. prefix reads from the event root, otherwise the value is read from .parsed_data.
      
      At runtime, each arg becomes a query parameter sent to the plugin endpoint: GET <endpoint>?<arg1>=<val1>&<arg2>=<val2>.
      
      For built-in plugins:
      
      k8s-pod-info: pod_name + namespace (both required).
      
      k8s-container-info: container_id (required; runtime prefixes like containerd:// are stripped automatically).
      
      k8s-nodeuser-info: uid (required; system UID from the event).
      - spec.produces.enrich.args.key
        
        string
        
        Maximum length: 256
      - spec.produces.enrich.args.value
        
        string
        
        Maximum length: 4096
    - spec.produces.enrich.plugin
      
      string
      Plugin name (required for source=Plugin). References an existing ClusterSecurityEventEnrichmentPlugin resource by its metadata.name.
      
      Built-in Internal plugins shipped with the module:
      
      k8s-pod-info — resolve Pod fields by pod name + namespace.
      
      k8s-container-info — resolve Pod fields by container runtime ID.
      
      k8s-nodeuser-info — resolve static-user username (nodeusers.deckhouse.io) by uid.
      
      To register custom enrichment endpoints, create ClusterSecurityEventEnrichmentPlugin resources of type External.
      
      Maximum length: 253
    - spec.produces.enrich.source
      
      string
      Enrichment source type.
      
      Allowed values: Static, Plugin
    - spec.produces.enrich.target
      
      string
      Destination field path in outgoing SecurityEvent (dot-separated).
      
      Length: 1..2048
    - spec.produces.enrich.value
      
      string
      For Static source: literal string to be written to target.
      
      For Plugin source: the response field to extract from the plugin’s JSON response. Must match one of the returns.fields[].name declared by the referenced ClusterSecurityEventEnrichmentPlugin resource. For example: serviceAccountName, name, namespace (k8s-pod-info / k8s-container-info), username (k8s-nodeuser-info).
      
      Maximum length: 2048
  - spec.produces.eventCode
    
    string
    Event code (references SecurityEventDefinition.spec.code).
    
    Length: 1..128
    
    Pattern: ^[A-Z0-9_]+$
  - spec.produces.extract
    
    object
    Detection rule for this produced event.
    
    This structure maps 1:1 into log-shipper ClusterLoggingConfig.spec.labelFilter item.
    
    Notes:
    
    values is required for In, NotIn, Regex, NotRegex.
    
    values must be omitted/empty for Exists, DoesNotExist.
    
    Allowed field values are message plus log-shipper metadata labels. Kubernetes: pod, namespace, pod_labels, pod_ip, image, container, node, pod_owner, node_group. File: host, host_ip, file.
    - spec.produces.extract.field
      
      string
      Required value
      
      Field name for filtering (same as ClusterLoggingConfig labelFilter.field). Typical values: message, file, namespace.
      
      Length: 1..2048
    - spec.produces.extract.operator
      
      string
      Required value
      
      Operator for field comparison (same as ClusterLoggingConfig labelFilter.operator).
      
      Allowed values: In, NotIn, Regex, NotRegex, Exists, DoesNotExist
    - spec.produces.extract.values
      
      array of strings
      Array of values or regexes for corresponding operations (same as ClusterLoggingConfig labelFilter.values).
  - spec.produces.transform
    
    array of objects
    Field mapping for transforming parsed raw logs into outgoing SecurityEvent.
    
    Keys are destination field paths in the outgoing event (dot-separated). Values are source field paths inside the parsed raw object (dot-separated, relative to .parsed_data). To read from root-level fields, use the @root. prefix (for example: metadata.extra.host_ip: @root.host_ip). A key that contains a dot is written in brackets and quotes, otherwise the dot reads as a step into a nested object (for example: actor.id: output_fields["user.name"]).
    
    Example: pod.name: pod_name will copy .parsed_data.pod_name into .pod.name.
    - spec.produces.transform.key
      
      string
      
      Maximum length: 256
    - spec.produces.transform.value
      
      string
      
      Maximum length: 4096
- spec.producesDefaults
  
  object
  Default mappings applied to all items in produces[] of this pipeline item.
  
  Precedence:
  - transform: keys are merged; defaults first, then produces[].transform overwrites.
  - enrich: used only when produces[].enrich is omitted.
  - spec.producesDefaults.enrich
    
    array of objects
    Default enrich rules (see produces[].enrich).
    - spec.producesDefaults.enrich.args
      
      array of objects
      Plugin arguments as key/value pairs. The key must match an arg name declared by the referenced ClusterSecurityEventEnrichmentPlugin CR (spec.args[].name). The value is a dot-path in the event resolved with the same logic as transform rules: a @root. prefix reads from the event root, otherwise the value is read from .parsed_data.
      
      At runtime, each arg becomes a query parameter sent to the plugin endpoint: GET <endpoint>?<arg1>=<val1>&<arg2>=<val2>.
      
      For built-in plugins:
      
      k8s-pod-info: pod_name + namespace (both required).
      
      k8s-container-info: container_id (required; runtime prefixes like containerd:// are stripped automatically).
      
      k8s-nodeuser-info: uid (required; system UID from the event).
      - spec.producesDefaults.enrich.args.key
        
        string
        
        Maximum length: 256
      - spec.producesDefaults.enrich.args.value
        
        string
        
        Maximum length: 4096
    - spec.producesDefaults.enrich.plugin
      
      string
      Plugin name (required for source=Plugin). References an existing ClusterSecurityEventEnrichmentPlugin resource by its metadata.name.
      
      Built-in Internal plugins shipped with the module:
      
      k8s-pod-info — resolve Pod fields by pod name + namespace.
      
      k8s-container-info — resolve Pod fields by container runtime ID.
      
      k8s-nodeuser-info — resolve static-user username (nodeusers.deckhouse.io) by uid.
      
      To register custom enrichment endpoints, create ClusterSecurityEventEnrichmentPlugin resources of type External.
      
      Maximum length: 253
    - spec.producesDefaults.enrich.source
      
      string
      Enrichment source type.
      
      Allowed values: Static, Plugin
    - spec.producesDefaults.enrich.target
      
      string
      Destination field path in outgoing SecurityEvent (dot-separated).
      
      Length: 1..2048
    - spec.producesDefaults.enrich.value
      
      string
      For Static source: literal string to be written to target.
      
      For Plugin source: the response field to extract from the plugin’s JSON response. Must match one of the returns.fields[].name declared by the referenced ClusterSecurityEventEnrichmentPlugin resource. For example: serviceAccountName, name, namespace (k8s-pod-info / k8s-container-info), username (k8s-nodeuser-info).
      
      Maximum length: 2048
  - spec.producesDefaults.transform
    
    array of objects
    Default field mapping (see produces[].transform).
    - spec.producesDefaults.transform.key
      
      string
      
      Maximum length: 256
    - spec.producesDefaults.transform.value
      
      string
      
      Maximum length: 4096
- spec.source
  
  string
  Source identifier (used for enable/disable via ClusterSecurityEventConfig).
  
  Length: 1..253
status

object
Current status of this resource.
- status.conditions
  
  array of objects
  Represents the latest available observations of an object’s state.
  - status.conditions.lastTransitionTime
    
    string
  - status.conditions.message
    
    string
    
    Maximum length: 32768
  - status.conditions.observedGeneration
    
    integer
  - status.conditions.reason
    
    string
    
    Length: 1..1024
  - status.conditions.status
    
    string
    
    Allowed values: True, False, Unknown
  - status.conditions.type
    
    string
    
    Maximum length: 316
- status.observedGeneration
  
  integer
  The generation observed by the controller.

PodSecurityEventShipper

Short names: pses

Scope: Namespaced
Version: v1alpha1

spec

array of objects
Namespaced pipelines for extracting security events from pod logs of this namespace. Namespace is implied and equals the PodSecurityEventShipper namespace.
- spec.input
  
  object
  - spec.input.kubernetesPods
    
    object
    Required value
    - spec.input.kubernetesPods.labelSelector
      
      object
      Required value
      
      Kubernetes-style label selector.
      - spec.input.kubernetesPods.labelSelector.matchExpressions
        
        array of objects
        List of label selector requirements.
        
        spec.input.kubernetesPods.labelSelector.matchExpressions.key
        
        string
        
        Length: 1..317
        
        spec.input.kubernetesPods.labelSelector.matchExpressions.operator
        
        string
        
        Allowed values: In, NotIn, Exists, DoesNotExist
        
        spec.input.kubernetesPods.labelSelector.matchExpressions.values
        
        array of strings
        
        spec.input.kubernetesPods.labelSelector.matchExpressions.values.Element of the array
        
        string
        
        Maximum length: 63
      - spec.input.kubernetesPods.labelSelector.matchLabels
        
        object
        Map of label key to value.
  - spec.input.type
    
    string
    Required value
    
    Allowed values: KubernetesPods
- spec.parser
  
  array of objects
  Parser rules (same shape as SecurityEventLoggingTransformationRules.spec.containers[]). Used by the gateway for best-effort parsing of raw logs .message into .parsed_data before applying transform mappings. Note: container is selected by log-shipper via labelFilter; name is the container name these rules apply to.
  - spec.parser.drop_raw
    
    boolean
    If true, removes the original raw message field after parsing.
    
    Default: false
  - spec.parser.fields
    
    array of objects
    Field type conversions applied after parsing.
    - spec.parser.fields.name
      
      string
      Field name in the parsed object.
      
      Length: 1..253
    - spec.parser.fields.type
      
      string
      Target field type.
      
      Allowed values: String, Int, Float, Bool
  - spec.parser.name
    
    string
    Container name.
    
    Length: 1..253
  - spec.parser.parser
    
    object
    Parser configuration.
    - spec.parser.parser.grok
      
      object
      Grok parser configuration.
      - spec.parser.parser.grok.customPatterns
        
        array of objects
        Custom grok pattern definitions (name -> regex).
        
        spec.parser.parser.grok.customPatterns.key
        
        string
        
        Maximum length: 256
        
        spec.parser.parser.grok.customPatterns.value
        
        string
        
        Maximum length: 4096
      - spec.parser.parser.grok.patterns
        
        array of strings
        Required value
        
        Grok patterns to try in order.
        
        spec.parser.parser.grok.patterns.Element of the array
        
        string
        
        Length: 1..16384
    - spec.parser.parser.regex
      
      object
      Regex parser configuration.
      - spec.parser.parser.regex.patterns
        
        array of strings
        Required value
        
        Regex patterns to try in order.
        
        spec.parser.parser.regex.patterns.Element of the array
        
        string
        
        Length: 1..16384
    - spec.parser.parser.type
      
      string
      Required value
      
      Parser type.
      
      JSON — parse the original log line as JSON;
      
      Regex — apply regular expressions and extract named capture groups;
      
      Grok — apply grok patterns and extract named fields.
      
      Allowed values: JSON, Regex, Grok
- spec.parserRef
  
  string
  Name of SecurityEventLoggingTransformationRules (SELTR) resource in the same namespace to use as parser rules. Used only when parser is not set.
  
  Length: 1..253
- spec.produces
  
  array of objects
  List of produced security events for this source.
  - spec.produces.enrich
    
    array of objects
    Enrichment rules for adding extra fields into outgoing SecurityEvent.
    
    Each rule writes into a destination field path (target). Sources:
    
    Static: write a literal string from value.
    
    Plugin: resolve a field at runtime via HTTP lookup to the enrichment-cache sidecar (in-memory Pod/NodeUser cache, no API server call per event). Plugins:
    
    k8s-pod-info, k8s-container-info: resolve Pod fields. Supports two lookup modes:
    
    Pod-name mode: args pod_name + namespace.
    
    Container-ID mode: arg container_id (resolves namespace, name, or serviceAccountName from the container runtime ID).
    
    k8s-nodeuser-info: resolve a static-user username (nodeusers.deckhouse.io) by uid. Arg uid (resolves the NodeUser metadata.name matching spec.uid).
    
    Enrich rules are applied after transform, so they override transform when targeting the same field.
    - spec.produces.enrich.args
      
      array of objects
      Plugin arguments as key/value pairs. The key must match an arg name declared by the referenced ClusterSecurityEventEnrichmentPlugin CR (spec.args[].name). The value is a dot-path in the event resolved with the same logic as transform rules: a @root. prefix reads from the event root, otherwise the value is read from .parsed_data.
      
      At runtime, each arg becomes a query parameter sent to the plugin endpoint: GET <endpoint>?<arg1>=<val1>&<arg2>=<val2>.
      
      For built-in plugins:
      
      k8s-pod-info: pod_name + namespace (both required).
      
      k8s-container-info: container_id (required; runtime prefixes like containerd:// are stripped automatically).
      
      k8s-nodeuser-info: uid (required; system UID from the event).
      - spec.produces.enrich.args.key
        
        string
        
        Maximum length: 256
      - spec.produces.enrich.args.value
        
        string
        
        Maximum length: 4096
    - spec.produces.enrich.plugin
      
      string
      Plugin name (required for source=Plugin). References an existing ClusterSecurityEventEnrichmentPlugin resource by its metadata.name.
      
      Built-in Internal plugins shipped with the module:
      
      k8s-pod-info — resolve Pod fields by pod name + namespace.
      
      k8s-container-info — resolve Pod fields by container runtime ID.
      
      k8s-nodeuser-info — resolve static-user username (nodeusers.deckhouse.io) by uid.
      
      To register custom enrichment endpoints, create ClusterSecurityEventEnrichmentPlugin resources of type External.
      
      Maximum length: 253
    - spec.produces.enrich.source
      
      string
      Enrichment source type.
      
      Allowed values: Static, Plugin
    - spec.produces.enrich.target
      
      string
      Destination field path in outgoing SecurityEvent (dot-separated).
      
      Length: 1..2048
    - spec.produces.enrich.value
      
      string
      For Static source: literal string to be written to target.
      
      For Plugin source: the response field to extract from the plugin’s JSON response. Must match one of the returns.fields[].name declared by the referenced ClusterSecurityEventEnrichmentPlugin resource. For example: serviceAccountName, name, namespace (k8s-pod-info / k8s-container-info), username (k8s-nodeuser-info).
      
      Maximum length: 2048
  - spec.produces.eventCode
    
    string
    Event code (references SecurityEventDefinition.spec.code).
    
    Length: 1..128
    
    Pattern: ^[A-Z0-9_]+$
  - spec.produces.extract
    
    object
    Detection rule for this produced event.
    
    This structure maps 1:1 into log-shipper PodLoggingConfig.spec.labelFilter item.
    
    Notes:
    
    values is required for In, NotIn, Regex, NotRegex.
    
    values must be omitted/empty for Exists, DoesNotExist.
    
    Allowed field values are message plus log-shipper metadata labels. Kubernetes: pod, namespace, pod_labels, pod_ip, image, container, node, pod_owner, node_group. File: host, host_ip, file.
    - spec.produces.extract.field
      
      string
      Required value
      
      Field name for filtering (same as PodLoggingConfig labelFilter.field). Typical values: message, container, namespace.
      
      Length: 1..2048
    - spec.produces.extract.operator
      
      string
      Required value
      
      Operator for field comparison (same as PodLoggingConfig labelFilter.operator).
      
      Allowed values: In, NotIn, Regex, NotRegex, Exists, DoesNotExist
    - spec.produces.extract.values
      
      array of strings
      Array of values or regexes for corresponding operations (same as PodLoggingConfig labelFilter.values).
  - spec.produces.transform
    
    array of objects
    Field mapping for transforming parsed raw logs into outgoing SecurityEvent.
    
    Keys are destination field paths in the outgoing event (dot-separated). Values are source field paths inside the parsed raw object (dot-separated, relative to .parsed_data). To read from root-level fields, use the @root. prefix (for example: metadata.extra.host_ip: @root.host_ip). A key that contains a dot is written in brackets and quotes, otherwise the dot reads as a step into a nested object (for example: actor.id: output_fields["user.name"]).
    
    Example: pod.name: pod_name will copy .parsed_data.pod_name into .pod.name.
    - spec.produces.transform.key
      
      string
      
      Maximum length: 256
    - spec.produces.transform.value
      
      string
      
      Maximum length: 4096
- spec.producesDefaults
  
  object
  Default mappings applied to all items in produces[] of this pipeline item.
  
  Precedence:
  - transform: keys are merged; defaults first, then produces[].transform overwrites.
  - enrich: used only when produces[].enrich is omitted.
  - spec.producesDefaults.enrich
    
    array of objects
    Default enrich rules (see produces[].enrich).
    - spec.producesDefaults.enrich.args
      
      array of objects
      Plugin arguments as key/value pairs. The key must match an arg name declared by the referenced ClusterSecurityEventEnrichmentPlugin CR (spec.args[].name). The value is a dot-path in the event resolved with the same logic as transform rules: a @root. prefix reads from the event root, otherwise the value is read from .parsed_data.
      
      At runtime, each arg becomes a query parameter sent to the plugin endpoint: GET <endpoint>?<arg1>=<val1>&<arg2>=<val2>.
      
      For built-in plugins:
      
      k8s-pod-info: pod_name + namespace (both required).
      
      k8s-container-info: container_id (required; runtime prefixes like containerd:// are stripped automatically).
      
      k8s-nodeuser-info: uid (required; system UID from the event).
      - spec.producesDefaults.enrich.args.key
        
        string
        
        Maximum length: 256
      - spec.producesDefaults.enrich.args.value
        
        string
        
        Maximum length: 4096
    - spec.producesDefaults.enrich.plugin
      
      string
      Plugin name (required for source=Plugin). References an existing ClusterSecurityEventEnrichmentPlugin resource by its metadata.name.
      
      Built-in Internal plugins shipped with the module:
      
      k8s-pod-info — resolve Pod fields by pod name + namespace.
      
      k8s-container-info — resolve Pod fields by container runtime ID.
      
      k8s-nodeuser-info — resolve static-user username (nodeusers.deckhouse.io) by uid.
      
      To register custom enrichment endpoints, create ClusterSecurityEventEnrichmentPlugin resources of type External.
      
      Maximum length: 253
    - spec.producesDefaults.enrich.source
      
      string
      Enrichment source type.
      
      Allowed values: Static, Plugin
    - spec.producesDefaults.enrich.target
      
      string
      Destination field path in outgoing SecurityEvent (dot-separated).
      
      Length: 1..2048
    - spec.producesDefaults.enrich.value
      
      string
      For Static source: literal string to be written to target.
      
      For Plugin source: the response field to extract from the plugin’s JSON response. Must match one of the returns.fields[].name declared by the referenced ClusterSecurityEventEnrichmentPlugin resource. For example: serviceAccountName, name, namespace (k8s-pod-info / k8s-container-info), username (k8s-nodeuser-info).
      
      Maximum length: 2048
  - spec.producesDefaults.transform
    
    array of objects
    Default field mapping (see produces[].transform).
    - spec.producesDefaults.transform.key
      
      string
      
      Maximum length: 256
    - spec.producesDefaults.transform.value
      
      string
      
      Maximum length: 4096
- spec.source
  
  string
  Source identifier (used for enable/disable via ClusterSecurityEventConfig).
  
  Length: 1..253
status

object
Current status of this resource.
- status.conditions
  
  array of objects
  Represents the latest available observations of an object’s state.
  - status.conditions.lastTransitionTime
    
    string
  - status.conditions.message
    
    string
    
    Maximum length: 32768
  - status.conditions.observedGeneration
    
    integer
  - status.conditions.reason
    
    string
    
    Length: 1..1024
  - status.conditions.status
    
    string
    
    Allowed values: True, False, Unknown
  - status.conditions.type
    
    string
    
    Maximum length: 316
- status.observedGeneration
  
  integer
  The generation observed by the controller.

SecurityEvent

Scope: Cluster
Version: v1

actor

object
Actor (subject) that performed the action.
- actor.id
  
  string
  Actor identifier.
  
  Maximum length: 512
- actor.type
  
  string
  Actor type.
  
  Allowed values: User, ServiceAccount, System
event

object
Event classification and details.
- event.category
  
  string
  Required value
  
  Event category.
  
  Allowed values: Auth, Rbac, Runtime, Network, Config
- event.code
  
  string
  Required value
  
  Event code.
  
  Maximum length: 128
- event.description
  
  string
  Human-readable event description.
  
  Maximum length: 4096
- event.outcome
  
  string
  Required value
  
  Event outcome.
  
  Allowed values: Success, Failure, Denied
- event.severity
  
  string
  Required value
  
  Event severity.
  
  Allowed values: Low, Medium, High, Critical
eventMetadata

object
Additional metadata.
- eventMetadata.cluster
  
  string
  Required value
  
  Cluster identifier.
  
  Maximum length: 253
- eventMetadata.extra
  
  array of objects
  Extra key-value metadata.
  - eventMetadata.extra.key
    
    string
    
    Maximum length: 256
  - eventMetadata.extra.value
    
    string
    
    Maximum length: 4096
- eventMetadata.node
  
  string
  Node name.
  
  Maximum length: 253
id

string
Unique event identifier.
object

object
Object the event is related to.
- object.name
  
  string
  Object name.
  
  Maximum length: 253
- object.namespace
  
  string
  Object namespace.
  
  Maximum length: 253
- object.type
  
  string
  Object type.
  
  Maximum length: 253
source

object
Source identification for the event.
- source.component
  
  string
  Required value
  
  Component name, for example kube-apiserver.
  
  Maximum length: 253
- source.instance
  
  string
  Instance identifier.
  
  Maximum length: 253
timestamp

string
Event timestamp.

SecurityEventDefinition

Short names: sed

Scope: Cluster
Version: v1alpha1

spec

object
Describes a possible security event.
- spec.category
  
  string
  Required value
  
  Event category.
  
  Allowed values: Auth, Rbac, Runtime, Network, Config
- spec.code
  
  string
  Required value
  
  Event code.
  
  Length: 1..128
  
  Pattern: ^[A-Z0-9_]+$
- spec.description
  
  string
  Required value
  
  Human-readable description.
  
  Length: 1..4096
- spec.descriptionRu
  
  string
  Human-readable description in Russian.
  
  Maximum length: 4096
- spec.fields
  
  array of objects
  List of fields that the event may contain.
  - spec.fields.name
    
    string
    Field name.
    
    Length: 1..253
  - spec.fields.required
    
    boolean
    Whether the field is required.
    
    Default: true
- spec.metadata
  
  object
  Metadata related to the rule
  - spec.metadata.docs
    
    object
    Human-readable description of the event, shown in documentation.
    - spec.metadata.docs.desc
      
      object
      - spec.metadata.docs.desc.en
        
        string
        Description in English.
        
        Maximum length: 4096
      - spec.metadata.docs.desc.ru
        
        string
        Description in Russian.
        
        Maximum length: 4096
  - spec.metadata.tests
    
    object
    How this event can be triggered when testing the module.
    - spec.metadata.tests.executionTarget
      
      string
      Where the trigger commands run.
      
      Allowed values: Host, Pod
    - spec.metadata.tests.testability
      
      string
      Whether the event can be triggered automatically.
      
      Allowed values: supported, unsupported, manual
    - spec.metadata.tests.trigger
      
      object
      - spec.metadata.tests.trigger.cleanupCommands
        
        array of strings
        Commands that undo what the trigger did.
        
        spec.metadata.tests.trigger.cleanupCommands.Element of the array
        
        string
        
        Maximum length: 4096
      - spec.metadata.tests.trigger.commands
        
        array of strings
        Commands that trigger the event.
        
        spec.metadata.tests.trigger.commands.Element of the array
        
        string
        
        Maximum length: 4096
- spec.severity
  
  string
  Required value
  
  Event severity.
  
  Allowed values: Low, Medium, High, Critical
- spec.source
  
  string
  Required value
  
  Source identifier.
  
  Length: 1..253
status

object
Current status of this resource.
- status.conditions
  
  array of objects
  Represents the latest available observations of an object’s state.
  - status.conditions.lastTransitionTime
    
    string
  - status.conditions.message
    
    string
    
    Maximum length: 32768
  - status.conditions.observedGeneration
    
    integer
  - status.conditions.reason
    
    string
    
    Length: 1..1024
  - status.conditions.status
    
    string
    
    Allowed values: True, False, Unknown
  - status.conditions.type
    
    string
    
    Maximum length: 316
- status.observedGeneration
  
  integer
  The generation observed by the controller.

SecurityEventLoggingTransformationRules

Short names: seltr

Scope: Namespaced
Version: v1alpha1

spec

object
Namespaced rules to transform raw log lines into structured objects (Vector events) before further processing.
- spec.containers
  
  array of objects
  Required value
  
  Per-container transformation rules.
  - spec.containers.drop_raw
    
    boolean
    If true, removes the original raw message field after parsing.
    
    Default: false
  - spec.containers.fields
    
    array of objects
    Field type conversions applied after parsing. Use them to enforce stable types for sinks such as Elasticsearch or ClickHouse.
    - spec.containers.fields.name
      
      string
      Field name in the parsed object.
      
      Length: 1..253
    - spec.containers.fields.type
      
      string
      Target field type.
      
      Allowed values: String, Int, Float, Bool
  - spec.containers.name
    
    string
    Container name to apply this transformation to.
    
    Length: 1..253
  - spec.containers.parser
    
    object
    Parser configuration that defines how to unpack the original log line.
    
    Parsing follows these rules:
    
    parsing is best-effort, so errors and mismatches do not drop events;
    
    for the Regex and Grok types, the first successfully matched pattern wins;
    
    named captures are written into .parsed_data.
    - spec.containers.parser.grok
      
      object
      Grok parser configuration. Named fields are saved into .parsed_data.
      - spec.containers.parser.grok.customPatterns
        
        array of objects
        Custom grok pattern definitions (name -> regex). These are added to the built-in grok patterns.
        
        spec.containers.parser.grok.customPatterns.key
        
        string
        
        Maximum length: 256
        
        spec.containers.parser.grok.customPatterns.value
        
        string
        
        Maximum length: 4096
      - spec.containers.parser.grok.patterns
        
        array of strings
        Required value
        
        Grok patterns to try in order. The first successfully matched pattern wins.
        
        spec.containers.parser.grok.patterns.Element of the array
        
        string
        
        Length: 1..16384
    - spec.containers.parser.regex
      
      object
      Regex parser configuration. Only named capture groups are saved into .parsed_data.
      - spec.containers.parser.regex.patterns
        
        array of strings
        Required value
        
        Regex patterns to try in order. The first successfully matched pattern wins.
        
        spec.containers.parser.regex.patterns.Element of the array
        
        string
        
        Length: 1..16384
    - spec.containers.parser.type
      
      string
      Required value
      
      Parser type.
      
      JSON — parse the original log line as JSON with parse_json();
      
      Regex — apply regular expressions and extract named capture groups;
      
      Grok — apply grok patterns and extract named fields.
      
      Allowed values: JSON, Regex, Grok
- spec.selector
  
  object
  Required value
  
  Pod label selector.
  
  Not used for matching. Pods are selected by the shipper that references these rules, through its own input.kubernetesPods.labelSelector. The field is kept required for compatibility and is ignored.
  - spec.selector.matchExpressions
    
    array of objects
    List of label selector requirements.
    - spec.selector.matchExpressions.key
      
      string
      
      Maximum length: 317
    - spec.selector.matchExpressions.operator
      
      string
      
      Allowed values: In, NotIn, Exists, DoesNotExist
    - spec.selector.matchExpressions.values
      
      array of strings
      - spec.selector.matchExpressions.values.Element of the array
        
        string
        
        Maximum length: 63
  - spec.selector.matchLabels
    
    object
    Map of label key to value.
status

object
Current status of this resource.
- status.conditions
  
  array of objects
  Represents the latest available observations of an object’s state.
  - status.conditions.lastTransitionTime
    
    string
  - status.conditions.message
    
    string
    
    Maximum length: 32768
  - status.conditions.observedGeneration
    
    integer
  - status.conditions.reason
    
    string
    
    Length: 1..1024
  - status.conditions.status
    
    string
    
    Allowed values: True, False, Unknown
  - status.conditions.type
    
    string
    
    Maximum length: 316
- status.observedGeneration
  
  integer
  The generation observed by the controller.

The security-events-manager module: custom resources

ClusterSecurityEventAlertRule

ClusterSecurityEventConfig

ClusterSecurityEventDestination

ClusterSecurityEventEnrichmentPlugin

ClusterSecurityEventLoggingTransformationRules

ClusterSecurityEventShipper

PodSecurityEventShipper

SecurityEvent

SecurityEventDefinition

SecurityEventLoggingTransformationRules

An error has occurred

Tell us what you didn’t like.

The security-events-manager module: custom resources

ClusterSecurityEventAlertRule

ClusterSecurityEventConfig

ClusterSecurityEventDestination

ClusterSecurityEventEnrichmentPlugin

ClusterSecurityEventLoggingTransformationRules

ClusterSecurityEventShipper

PodSecurityEventShipper

SecurityEvent

SecurityEventDefinition

SecurityEventLoggingTransformationRules

An error has occurred

Tell us what you didn’t like.

Request trial access

Thank you

Error

Request callback

Thank you

Something went wrong

Book your sessions

Thank you

Error

Request demo

Thank you

Error

Get the PCI SSC Compliance Report

Thank you

Error