The security-events-manager module: custom resources

ClusterSecurityEventAlertRule

Short names: csear

Scope: Cluster
Version: v1alpha1

• spec

  object

  Turns security events into a Prometheus alert.

  Matched events are counted per key over a time window, and the rule fires once the count reaches the threshold. Without aggregation every matched event fires the rule.

  A firing rule raises the D8SecurityEventAlertFiring alert, which reaches operators the way every other cluster alert does: as a ClusterAlert object, in the console, and through the cluster’s own alert delivery. There is nothing to configure for delivery.

  • spec.aggregation

    object

    Counting rule.

    Events are grouped by groupBy and the alert fires as soon as a group reaches threshold within window. Counting then restarts for that group.

    Counters live in memory, so a restart of the aggregator starts the window anew.

    • spec.aggregation.groupBy

      array of strings

      Required value

      Event fields that identify a group.

      Their values become alert labels, so the list is restricted to fields with bounded cardinality: a key like an object name would create a group per event, grow the aggregator without bound and flood the alert receiver.

      • spec.aggregation.groupBy.Element of the array

        string

        Event field to group by, named after the field it reads: EventCode (event.code), EventSeverity (event.severity), EventCategory (event.category), SourceComponent (source.component), ActorID (actor.id), ActorSourceIP (actor.sourceIP), ObjectNamespace (object.namespace), ObjectType (object.type). The label on the alert carries the field path, so ActorID shows up as actor_id.

        Allowed values: EventCode, EventSeverity, EventCategory, SourceComponent, ActorID, ActorSourceIP, ObjectNamespace, ObjectType

    • spec.aggregation.threshold

      integer

      Required value

      Number of events in a group that triggers the alert.

      Use a rule without aggregation to alert on every event.

    • spec.aggregation.window

      string

      Required value

      How long a group keeps counting before it is forgotten.

      Digits followed by s, m or h, for example 5m. Pick the span the behaviour you are describing happens within: brute force is minutes, a slow sweep is hours.

      Pattern: ^[0-9]+(s|m|h)$

  • spec.alert

    object

    Required value

    What is sent when the rule fires.
    • spec.alert.description

      string

      Longer description, shown as the alert’s description annotation.

      Say what to check and where, the way a runbook would.

    • spec.alert.labels

      object

      Extra alert labels, added next to rule, severity_level and the groupBy keys.

      Labels identify the alert: two alerts with the same labels are the same alert.

    • spec.alert.severityLevel

      integer

      DKP severity level, sent as the severity_level label.

      Keep in mind that on clusters with update.blockOnAlerts enabled in the deckhouse module, an alert with a level at or below the configured threshold (4 by default) blocks DKP releases from being applied.

      Default: 6

    • spec.alert.summary

      string

      Required value

      Short one-line summary, shown as the alert’s summary annotation, for example One actor read an unusual number of secrets.
  • spec.match

    object

    Required value

    Which security events this rule applies to.

    Criteria are combined with AND.

    • spec.match.actorType

      string

      Narrow the rule to a kind of subject.

      ServiceAccounts keeps only actors matching system:serviceaccount:*; NonServiceAccounts keeps everything else, which is how you write a rule about people and other outside clients. Mirrors the console’s “Subject type” filter.

      Default: Any

      Allowed values: Any, ServiceAccounts, NonServiceAccounts

    • spec.match.actors

      array of strings

      Only count events from these actors, matched against actor.id the same way as excludeActors: * stands for any sequence of characters, everything else is literal.

      Useful for watching a specific subject, for example a ServiceAccount that must not change secrets.

    • spec.match.categories

      array of strings

      Event categories to match, as declared in SecurityEventDefinition.spec.category.
      • spec.match.categories.Element of the array

        string

        Allowed values: Auth, Rbac, Runtime, Network, Config

    • spec.match.eventCodes

      array of strings

      Event codes to match, as declared in SecurityEventDefinition.
      • spec.match.eventCodes.Element of the array

        string

        For example K8S_SECRET_ACCESSED.

        Pattern: ^[A-Z][A-Z0-9_]*$

    • spec.match.excludeActors

      array of strings

      Actors whose events the rule ignores, matched against actor.id.

      A * stands for any sequence of characters; everything else is literal.

      Platform components generate most of the routine activity — on an idle cluster the Deckhouse ServiceAccount alone accounts for thousands of secret reads per hour — so a rule about people and workloads needs them out of the way. Typical list:

      excludeActors:
        - "system:serviceaccount:d8-*"
        - "system:serviceaccount:kube-system:*"
        - "system:node:*"
        - "system:apiserver"

    • spec.match.excludeSystemActors

      boolean

      Ignore events produced by the platform itself.

      Routine cluster work touches secrets, RBAC and pods constantly — on an idle cluster the Deckhouse ServiceAccount alone accounted for 2617 of 2812 secret reads in an hour — and a rule about people and workloads drowns in it.

      The list is maintained by the module and matches the “Exclude system” filter of the console, so hiding platform noise in the interface and writing a rule put the same events out of the way. It covers actor.id matching system:serviceaccount:kube-system:*, system:serviceaccount:d8-*, system:node:*, system:kube-*, system:apiserver and kubernetes-admin.

      Nothing is removed from the event stream: the events are still collected and delivered, this rule just stops counting them. Events without an actor are kept, and anonymous or unauthenticated identities are never treated as platform actors — those are what a security rule is looking for.

      Default: true

    • spec.match.severityMin

      string

      Minimal event severity to match (inclusive).

      Allowed values: Low, Medium, High, Critical

    • spec.match.sources

      array of strings

      Source components to match, as declared in SecurityEventDefinition.spec.source (for example kube-audit).
• status

  object

  Current status of this resource.
  • status.conditions

    array of objects

    Represents the latest available observations of an object’s state.
    • status.conditions.lastTransitionTime

      string
    • status.conditions.message

      string

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer
    • status.conditions.reason

      string

      Length: 1..1024

    • status.conditions.status

      string

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Maximum length: 316

  • status.observedGeneration

    integer

    The generation observed by the controller.

ClusterSecurityEventConfig

Short names: csec

Scope: Cluster
Version: v1alpha1

• spec

  object

  Defines which sources are enabled and which destinations they should be shipped to.
  • spec.cef

    object

    Default CEF (Common Event Format) metadata for destinations that use CEF encoding. These values are used when a ClusterSecurityEventDestination has encoding.codec=CEF but does not specify its own cef.deviceVendor/deviceProduct/deviceVersion.
    • spec.cef.deviceProduct

      string

      Default device product for CEF header.

      Default: security-events-manager

    • spec.cef.deviceVendor

      string

      Default device vendor for CEF header.

      Default: Deckhouse

    • spec.cef.deviceVersion

      string

      Default device version for CEF header.

      Default: 1

  • spec.defaultSeverityThreshold

    string

    Required value

    Minimal severity to ship (inclusive).

    Allowed values: Low, Medium, High, Critical

  • spec.destinations

    array of strings

    Required value

    List of ClusterSecurityEventDestination names.
  • spec.enabledSources

    array of strings

    If set, only these sources are enabled. If omitted, all sources are enabled. Expected format:

    • clusterSecurityEventShipper//<source>
    • podSecurityEventShipper/<namespace>//<source>
    • spec.enabledSources.Element of the array

      string

      Pattern: ^(clusterSecurityEventShipper/[^/]+/[^/]+|podSecurityEventShipper/[^/]+/[^/]+/[^/]+)$

  • spec.enabledSourcesMasks

    array of strings

    If set, only sources matching these glob-style masks are enabled. If omitted, all sources are enabled. Masks use ‘*’ to match any substring (including ‘/’). You must set either enabledSources or enabledSourcesMasks, but not both. Expected format:

    • clusterSecurityEventShipper//<source>
    • podSecurityEventShipper/<namespace>//<source> Examples:
    • podSecurityEventShipper/*
    • clusterSecurityEventShipper/kube-audit/*
    • spec.enabledSourcesMasks.Element of the array

      string

      Pattern: ^(clusterSecurityEventShipper/.+|podSecurityEventShipper/.+)$

• status

  object

  Current status of this resource.
  • status.conditions

    array of objects

    Represents the latest available observations of an object’s state.
    • status.conditions.lastTransitionTime

      string
    • status.conditions.message

      string

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer
    • status.conditions.reason

      string

      Length: 1..1024

    • status.conditions.status

      string

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Maximum length: 316

  • status.observedGeneration

    integer

    The generation observed by the controller.

ClusterSecurityEventDestination

Short names: csed

Scope: Cluster
Version: v1alpha1

• spec

  object

  Describes where to send security events.

  Fields are designed to be translated to deckhouse.io/log-shipper ClusterLogDestination.

  • spec.buffer

    object

    Per-destination buffer settings for the gateway Vector sink.

    Overrides the global gateway.buffer defaults from module values. If not set, the global defaults are used.

    • spec.buffer.maxEvents

      integer

      Maximum number of events in the buffer.

      Used as a secondary limit for Memory type. Ignored when type=Disk (disk buffer uses maxSize only).

      Default: 500

    • spec.buffer.maxSize

      string

      Maximum size of the buffer as a Kubernetes quantity string with a mandatory unit suffix (e.g. “512Mi”, “1Gi”, “256Mi”).

      Plain numbers without a unit suffix are NOT accepted. For Disk: maximum disk space used on the volume. For Memory: approximate memory limit for the in-memory ring buffer.

      Default: 512Mi

      Pattern: ^[0-9]+(\.[0-9]+)?(Ki|Mi|Gi|Ti|Pi|Ei|k|M|G|T|P|E)$

    • spec.buffer.type

      string

      Buffer type.

      Possible values:

      • Disk: disk-based buffer using LevelDB. Survives Vector process restarts within the pod. DEFAULT — ensures no security events are lost during temporary destination outages.
      • Memory: in-memory ring buffer. Faster, but all events are lost on Vector process restart. Use only for test/dev environments.

      Default: Disk

      Allowed values: Memory, Disk

    • spec.buffer.whenFull

      string

      Behavior when the buffer is full.

      Possible values:

      • Block: apply backpressure to upstream. Pipeline slows down but NO events are lost. DEFAULT — the correct choice for security events.
      • DropNewest: discard incoming events. Data loss occurs but no backpressure. Use only when data loss is acceptable (test environments).

      Default: Block

      Allowed values: Block, DropNewest

  • spec.console

    object
    • spec.console.encoding

      object

      Encoding format for events sent to console.

      Default is JSON. Set codec to CEF to emit events in Common Event Format.

      • spec.console.encoding.cef

        object

        CEF-specific configuration fields.

        Only applicable when codec is set to CEF. If omitted, defaults are used: deviceVendor=Deckhouse, deviceProduct=security-events-manager, version=1.

        • spec.console.encoding.cef.deviceProduct

          string

          Device product field in the CEF header.

          Default: security-events-manager

        • spec.console.encoding.cef.deviceVendor

          string

          Device vendor field in the CEF header.

          Default: Deckhouse

        • spec.console.encoding.cef.deviceVersion

          string

          Device version field in the CEF header.

          Default: 1

      • spec.console.encoding.codec

        string

        Encoding codec for the destination.

        Possible values:

        • JSON: structured JSON (default, suitable for Loki, ES, Kafka, etc.).
        • CEF: Common Event Format (suitable for SIEM integration via Kafka, Vector, File, Console).

        Default: JSON

        Allowed values: JSON, CEF

      • spec.console.encoding.syslogWrapper

        string

        Optional syslog header wrapping for CEF output.

        Only applicable when codec is CEF.

        Possible values:

        • None: emit bare CEF string (default).
        • RFC3164: prepend RFC 3164 (BSD syslog) header.
        • RFC5424: prepend RFC 5424 (IETF syslog) header.

        Default: None

        Allowed values: None, RFC3164, RFC5424

    • spec.console.target

      string

      Default: Stdout

      Allowed values: Stdout, Stderr

  • spec.elasticsearch

    object
    • spec.elasticsearch.auth

      object
      • spec.elasticsearch.auth.password

        string

        Password for Basic authentication.

        Consider using passwordSecretRef instead to avoid storing secrets in the CR spec.

      • spec.elasticsearch.auth.passwordSecretRef

        object
        • spec.elasticsearch.auth.passwordSecretRef.name

          string

          Required value

          Name of the secret in the d8-security-events-manager namespace containing the credential.

          The secret must have the key value in its data field.

      • spec.elasticsearch.auth.strategy

        string

        Default: None

        Allowed values: None, Bearer, Basic

      • spec.elasticsearch.auth.token

        string

        Bearer token for authentication.

        Consider using tokenSecretRef instead to avoid storing secrets in the CR spec.

      • spec.elasticsearch.auth.tokenSecretRef

        object
        • spec.elasticsearch.auth.tokenSecretRef.name

          string

          Required value

          Name of the secret in the d8-security-events-manager namespace containing the credential.

          The secret must have the key value in its data field.

      • spec.elasticsearch.auth.username

        string
    • spec.elasticsearch.endpoint

      string

      Required value
    • spec.elasticsearch.index

      string
    • spec.elasticsearch.tls

      object
      • spec.elasticsearch.tls.ca

        string

        Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      • spec.elasticsearch.tls.verifyCertificate

        boolean

        Default: true

      • spec.elasticsearch.tls.verifyHostname

        boolean

        Default: true

  • spec.file

    object
    • spec.file.encoding

      object

      Encoding format for events written to this file destination.

      Default is JSON. Set codec to CEF to write events in Common Event Format.

      • spec.file.encoding.cef

        object

        CEF-specific configuration fields.

        Only applicable when codec is set to CEF. If omitted, defaults are used: deviceVendor=Deckhouse, deviceProduct=security-events-manager, version=1.

        • spec.file.encoding.cef.deviceProduct

          string

          Device product field in the CEF header.

          Default: security-events-manager

        • spec.file.encoding.cef.deviceVendor

          string

          Device vendor field in the CEF header.

          Default: Deckhouse

        • spec.file.encoding.cef.deviceVersion

          string

          Device version field in the CEF header.

          Default: 1

      • spec.file.encoding.codec

        string

        Encoding codec for the destination.

        Possible values:

        • JSON: structured JSON (default, suitable for Loki, ES, Kafka, etc.).
        • CEF: Common Event Format (suitable for SIEM integration via Kafka, Vector, File, Console).

        Default: JSON

        Allowed values: JSON, CEF

      • spec.file.encoding.syslogWrapper

        string

        Optional syslog header wrapping for CEF output.

        Only applicable when codec is CEF.

        Possible values:

        • None: emit bare CEF string (default).
        • RFC3164: prepend RFC 3164 (BSD syslog) header.
        • RFC5424: prepend RFC 5424 (IETF syslog) header.

        Default: None

        Allowed values: None, RFC3164, RFC5424

    • spec.file.path

      string

      Required value
  • spec.http

    object
    • spec.http.auth

      object
      • spec.http.auth.password

        string

        Password for Basic authentication.

        Consider using passwordSecretRef instead to avoid storing secrets in the CR spec.

      • spec.http.auth.passwordSecretRef

        object
        • spec.http.auth.passwordSecretRef.name

          string

          Required value

          Name of the secret in the d8-security-events-manager namespace containing the credential.

          The secret must have the key value in its data field.

      • spec.http.auth.strategy

        string

        Default: None

        Allowed values: None, Bearer, Basic

      • spec.http.auth.token

        string

        Bearer token for authentication.

        Consider using tokenSecretRef instead to avoid storing secrets in the CR spec.

      • spec.http.auth.tokenSecretRef

        object
        • spec.http.auth.tokenSecretRef.name

          string

          Required value

          Name of the secret in the d8-security-events-manager namespace containing the credential.

          The secret must have the key value in its data field.

      • spec.http.auth.username

        string
    • spec.http.endpoint

      string

      Required value

      Full URL to send events to, including the path, for example https://collector.example.com/api/ingest.

      Events are always sent with the POST method.

    • spec.http.framing

      string

      How a set of events is laid out in the request body.

      JSONArray wraps the set into a single JSON array, which is what receivers expecting one document per request read. NewlineDelimited sends one JSON object per line (NDJSON), which suits collectors that read a stream of records.

      Default: JSONArray

      Allowed values: JSONArray, NewlineDelimited

    • spec.http.headers

      object

      Additional request headers.

      The Authorization header is managed by auth and must not be set here.

    • spec.http.tls

      object
      • spec.http.tls.ca

        string

        Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      • spec.http.tls.verifyCertificate

        boolean

        Default: true

      • spec.http.tls.verifyHostname

        boolean

        Default: true

  • spec.kafka

    object
    • spec.kafka.brokers

      array of strings

      Required value
    • spec.kafka.encoding

      object

      Encoding format for events sent to this Kafka destination.

      Default is JSON. Set codec to CEF to emit events in Common Event Format (requires a CEF-capable SIEM consumer on the receiving end).

      • spec.kafka.encoding.cef

        object

        CEF-specific configuration fields.

        Only applicable when codec is set to CEF. If omitted, defaults are used: deviceVendor=Deckhouse, deviceProduct=security-events-manager, version=1.

        • spec.kafka.encoding.cef.deviceProduct

          string

          Device product field in the CEF header.

          Default: security-events-manager

        • spec.kafka.encoding.cef.deviceVendor

          string

          Device vendor field in the CEF header.

          Default: Deckhouse

        • spec.kafka.encoding.cef.deviceVersion

          string

          Device version field in the CEF header.

          Default: 1

      • spec.kafka.encoding.codec

        string

        Encoding codec for the destination.

        Possible values:

        • JSON: structured JSON (default, suitable for Loki, ES, Kafka, etc.).
        • CEF: Common Event Format (suitable for SIEM integration via Kafka, Vector, File, Console).

        Default: JSON

        Allowed values: JSON, CEF

      • spec.kafka.encoding.syslogWrapper

        string

        Optional syslog header wrapping for CEF output.

        Only applicable when codec is CEF.

        Possible values:

        • None: emit bare CEF string (default).
        • RFC3164: prepend RFC 3164 (BSD syslog) header.
        • RFC5424: prepend RFC 5424 (IETF syslog) header.

        Default: None

        Allowed values: None, RFC3164, RFC5424

    • spec.kafka.sasl

      object
      • spec.kafka.sasl.mechanism

        string

        Allowed values: Plain, SCRAM-SHA-256, SCRAM-SHA-512

      • spec.kafka.sasl.password

        string

        SASL password.

        Consider using passwordSecretRef instead to avoid storing secrets in the CR spec.

      • spec.kafka.sasl.passwordSecretRef

        object
        • spec.kafka.sasl.passwordSecretRef.name

          string

          Required value

          Name of the secret in the d8-security-events-manager namespace containing the credential.

          The secret must have the key value in its data field.

      • spec.kafka.sasl.username

        string
    • spec.kafka.tls

      object
      • spec.kafka.tls.ca

        string

        Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      • spec.kafka.tls.verifyCertificate

        boolean

        Default: true

      • spec.kafka.tls.verifyHostname

        boolean

        Default: true

    • spec.kafka.topic

      string

      Required value
  • spec.loki

    object
    • spec.loki.auth

      object
      • spec.loki.auth.password

        string

        Password for Basic authentication.

        Consider using passwordSecretRef instead to avoid storing secrets in the CR spec.

      • spec.loki.auth.passwordSecretRef

        object
        • spec.loki.auth.passwordSecretRef.name

          string

          Required value

          Name of the secret in the d8-security-events-manager namespace containing the credential.

          The secret must have the key value in its data field.

      • spec.loki.auth.strategy

        string

        Default: None

        Allowed values: None, Bearer, Basic

      • spec.loki.auth.token

        string

        Bearer token for authentication.

        Consider using tokenSecretRef instead to avoid storing secrets in the CR spec.

      • spec.loki.auth.tokenSecretRef

        object
        • spec.loki.auth.tokenSecretRef.name

          string

          Required value

          Name of the secret in the d8-security-events-manager namespace containing the credential.

          The secret must have the key value in its data field.

      • spec.loki.auth.username

        string
    • spec.loki.endpoint

      string

      Required value
    • spec.loki.tls

      object
      • spec.loki.tls.ca

        string

        Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      • spec.loki.tls.verifyCertificate

        boolean

        Default: true

      • spec.loki.tls.verifyHostname

        boolean

        Default: true

  • spec.socket

    object
    • spec.socket.address

      string

      Required value

      The address to connect to.

      Format depends on mode:

      • TCP: “host:port” (e.g. “siem.example.com:514”)
      • UDP: “host:port” (e.g. “siem.example.com:514”)
      • Unix: “/path/to/socket” (e.g. “/var/run/siem.sock”)
    • spec.socket.encoding

      object

      Encoding format for events sent to this socket destination.

      Default is JSON. Set codec to CEF to emit events in Common Event Format (the primary use-case for syslog-based SIEM integrations).

      • spec.socket.encoding.cef

        object

        CEF-specific configuration fields.

        Only applicable when codec is set to CEF. If omitted, defaults are used: deviceVendor=Deckhouse, deviceProduct=security-events-manager, version=1.

        • spec.socket.encoding.cef.deviceProduct

          string

          Device product field in the CEF header.

          Default: security-events-manager

        • spec.socket.encoding.cef.deviceVendor

          string

          Device vendor field in the CEF header.

          Default: Deckhouse

        • spec.socket.encoding.cef.deviceVersion

          string

          Device version field in the CEF header.

          Default: 1

      • spec.socket.encoding.codec

        string

        Encoding codec for the destination.

        Possible values:

        • JSON: structured JSON (default, suitable for Loki, ES, Kafka, etc.).
        • CEF: Common Event Format (suitable for SIEM integration via Kafka, Vector, File, Console).

        Default: JSON

        Allowed values: JSON, CEF

      • spec.socket.encoding.syslogWrapper

        string

        Optional syslog header wrapping for CEF output.

        Only applicable when codec is CEF.

        Possible values:

        • None: emit bare CEF string (default).
        • RFC3164: prepend RFC 3164 (BSD syslog) header.
        • RFC5424: prepend RFC 5424 (IETF syslog) header.

        Default: None

        Allowed values: None, RFC3164, RFC5424

    • spec.socket.mode

      string

      Required value

      Socket transport mode.

      Possible values:

      • TCP: stream-oriented, reliable, supports TLS. Recommended for production syslog.
      • UDP: datagram-oriented, fire-and-forget. Max message size limited by MTU.
      • Unix: local Unix domain socket (stream mode). For sidecar-based SIEM agents.

      Allowed values: TCP, UDP, Unix

    • spec.socket.tls

      object

      TLS configuration.

      Only applicable when mode is TCP. Ignored for UDP and Unix modes.

      • spec.socket.tls.ca

        string

        Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      • spec.socket.tls.verifyCertificate

        boolean

        Default: true

      • spec.socket.tls.verifyHostname

        boolean

        Default: true

  • spec.splunkHEC

    object
    • spec.splunkHEC.endpoint

      string

      Required value
    • spec.splunkHEC.tls

      object
      • spec.splunkHEC.tls.ca

        string

        Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      • spec.splunkHEC.tls.verifyCertificate

        boolean

        Default: true

      • spec.splunkHEC.tls.verifyHostname

        boolean

        Default: true

    • spec.splunkHEC.token

      string

      Splunk HEC token.

      Consider using tokenSecretRef instead to avoid storing secrets in the CR spec.

    • spec.splunkHEC.tokenSecretRef

      object
      • spec.splunkHEC.tokenSecretRef.name

        string

        Required value

        Name of the secret in the d8-security-events-manager namespace containing the credential.

        The secret must have the key value in its data field.

  • spec.type

    string

    Required value

    Allowed values: Loki, Elasticsearch, Kafka, SplunkHEC, File, Console, Vector, Socket, Http

  • spec.vector

    object
    • spec.vector.encoding

      object

      Encoding format for events sent to this Vector destination.

      Default is JSON. Set codec to CEF to emit events in Common Event Format.

      • spec.vector.encoding.cef

        object

        CEF-specific configuration fields.

        Only applicable when codec is set to CEF. If omitted, defaults are used: deviceVendor=Deckhouse, deviceProduct=security-events-manager, version=1.

        • spec.vector.encoding.cef.deviceProduct

          string

          Device product field in the CEF header.

          Default: security-events-manager

        • spec.vector.encoding.cef.deviceVendor

          string

          Device vendor field in the CEF header.

          Default: Deckhouse

        • spec.vector.encoding.cef.deviceVersion

          string

          Device version field in the CEF header.

          Default: 1

      • spec.vector.encoding.codec

        string

        Encoding codec for the destination.

        Possible values:

        • JSON: structured JSON (default, suitable for Loki, ES, Kafka, etc.).
        • CEF: Common Event Format (suitable for SIEM integration via Kafka, Vector, File, Console).

        Default: JSON

        Allowed values: JSON, CEF

      • spec.vector.encoding.syslogWrapper

        string

        Optional syslog header wrapping for CEF output.

        Only applicable when codec is CEF.

        Possible values:

        • None: emit bare CEF string (default).
        • RFC3164: prepend RFC 3164 (BSD syslog) header.
        • RFC5424: prepend RFC 5424 (IETF syslog) header.

        Default: None

        Allowed values: None, RFC3164, RFC5424

    • spec.vector.endpoint

      string

      Required value
    • spec.vector.tls

      object
      • spec.vector.tls.ca

        string

        Base64-encoded PEM with the CA certificate chain used to verify the destination server certificate.
      • spec.vector.tls.verifyCertificate

        boolean

        Default: true

      • spec.vector.tls.verifyHostname

        boolean

        Default: true

ClusterSecurityEventEnrichmentPlugin

Short names: csep

Scope: Cluster
Version: v1alpha1

• spec

  object

  Describes an enrichment plugin — an HTTP endpoint that resolves additional fields for outgoing SecurityEvents at runtime.

  • Internal plugins are served by the built-in enrichment-cache sidecar in the gateway pod. The module ships three Internal plugins: k8s-pod-info, k8s-container-info, k8s-nodeuser-info. Internal CRs are managed by Deckhouse and cannot be created or modified by users.

  • External plugins are served by user-deployed pods in any namespace. The user provides the endpoint URL, optional TLS/auth, arg schema, and return field schema.

  • spec.args

    array of objects

    Required value

    Declares the input arguments (query parameters) that the plugin accepts. Each arg has a name, a required flag, and a description.

    When a ShipperEnrichRule references this plugin, its args values are resolved from event fields (dot-paths) and sent as query parameters to the plugin endpoint.

    The controller validates that all required: true args are present in the referencing ShipperEnrichRule.

    • spec.args.description

      string

      Human-readable description of the argument.
    • spec.args.name

      string

      Argument name (used as the query parameter key).
    • spec.args.required

      boolean

      Whether the argument is required in ShipperEnrichRule.

      Default: true

  • spec.description

    string

    Human-readable description of the plugin.
  • spec.endpoint

    object

    HTTP endpoint configuration. Required for External plugins. Ignored for Internal plugins (the sidecar URL is used automatically).
    • spec.endpoint.headers

      array of objects

      Optional static HTTP headers sent with each lookup request.
      • spec.endpoint.headers.name

        string
      • spec.endpoint.headers.value

        string
    • spec.endpoint.tls

      object

      TLS configuration for the HTTPS endpoint (optional).
      • spec.endpoint.tls.caSecret

        string

        Name of a Secret in the module namespace (d8-security-events-manager) containing the CA certificate (key ca.crt). Used to verify the plugin endpoint’s TLS certificate.
      • spec.endpoint.tls.clientCertSecret

        string

        Name of a Secret in the module namespace containing the client certificate and key for mTLS (keys tls.crt, tls.key).
    • spec.endpoint.url

      string

      Required value

      Full HTTP(S) URL of the enrichment endpoint. The controller generates: GET <url>?<args as query params>. Must start with http:// or https://. Must not reference cloud metadata endpoints (e.g. 169.254.x.x) or link-local addresses to prevent SSRF.
  • spec.readiness

    object

    Optional readiness probe. The controller can probe this endpoint before including the plugin in the gateway config. If unreachable, the controller sets a NotReady status condition.
    • spec.readiness.expectedStatus

      integer

      Expected HTTP status code for a ready plugin.

      Default: 200

    • spec.readiness.path

      string

      HTTP path to probe (appended to endpoint.url).

      Default: /healthz

  • spec.returns

    object

    Required value

    Declares the fields that the plugin returns in its JSON response. Used for validation: the value in a referencing ShipperEnrichRule must match one of the fields[].name listed here.
    • spec.returns.fields

      array of objects

      Required value
      • spec.returns.fields.description

        string

        Human-readable description of the field.
      • spec.returns.fields.name

        string

        Response field name.
      • spec.returns.fields.type

        string

        Field type.

        Allowed values: String, Int, Bool

  • spec.type

    string

    Required value

    Plugin type.

    • Internal — served by the built-in enrichment-cache sidecar (no endpoint needed).
    • External — served by a user-deployed pod (endpoint.url required).

    Allowed values: Internal, External

• status

  object

  Current status of this resource.
  • status.conditions

    array of objects

    Represents the latest available observations of an object’s state.
    • status.conditions.lastTransitionTime

      string
    • status.conditions.message

      string

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer
    • status.conditions.reason

      string

      Length: 1..1024

    • status.conditions.status

      string

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Maximum length: 316

  • status.observedGeneration

    integer

    The generation observed by the controller.

ClusterSecurityEventLoggingTransformationRules

Short names: cseltr

Scope: Cluster
Version: v1alpha1

• spec

  object

  Cluster-wide rules to transform raw log lines into structured objects (Vector events) before further processing.

  Namespaced SecurityEventLoggingTransformationRules (SELTR) take precedence over these rules when both match the same pod/container.

  • spec.file

    object

    Selection + shared transform for node file logs. Required when type is File.

    File match is performed against the Vector event field .file.

    • spec.file.paths

      array of strings

      Required value

      Exact file paths to match.
    • spec.file.transform

      object

      Required value

      Shared transformation applied to every matched file log line.
      • spec.file.transform.drop_raw

        boolean

        Default: false

      • spec.file.transform.fields

        array of objects
        • spec.file.transform.fields.name

          string

          Field name in the parsed object.
        • spec.file.transform.fields.type

          string

          Target field type.

          Allowed values: String, Int, Float, Bool

      • spec.file.transform.parser

        object

        Required value

        Parser configuration (defines how to unpack the original log line).

        Semantics:

        • parsing is best-effort (errors/mismatches do not drop events)
        • first successful pattern wins (for Regex/Grok)
        • named captures are written into .parsed_data
        • spec.file.transform.parser.grok

          object

          Grok parser configuration. Named fields are saved into .parsed_data.
          • spec.file.transform.parser.grok.customPatterns

            array of objects

            Custom grok pattern definitions (name -> regex). These are added to the built-in grok patterns.
            • spec.file.transform.parser.grok.customPatterns.key

              string
            • spec.file.transform.parser.grok.customPatterns.value

              string
          • spec.file.transform.parser.grok.patterns

            array of strings

            Required value

            Grok patterns to try in order. The first successfully matched pattern wins.
        • spec.file.transform.parser.regex

          object

          Regex parser configuration. Only named capture groups are saved into .parsed_data.
          • spec.file.transform.parser.regex.patterns

            array of strings

            Required value

            Regex patterns to try in order. The first successfully matched pattern wins.
        • spec.file.transform.parser.type

          string

          Required value

          Parser type.

          • JSON: parse the original log line as JSON (parse_json()).
          • Regex: apply regex patterns and extract named capture groups.
          • Grok: apply grok patterns and extract named fields.

          Allowed values: JSON, Regex, Grok

  • spec.kubernetesPods

    object

    Selection + per-container transforms for Kubernetes pod logs. Required when type is KubernetesPods.
    • spec.kubernetesPods.containers

      array of objects

      Required value

      Per-container transformation rules.
      • spec.kubernetesPods.containers.drop_raw

        boolean

        If true, removes the original raw message field after parsing.

        Default: false

      • spec.kubernetesPods.containers.fields

        array of objects

        Optional field type conversions applied after parsing. Useful to enforce stable types for sinks (Elasticsearch/ClickHouse/etc.).
        • spec.kubernetesPods.containers.fields.name

          string

          Field name in the parsed object.
        • spec.kubernetesPods.containers.fields.type

          string

          Target field type.

          Allowed values: String, Int, Float, Bool

      • spec.kubernetesPods.containers.name

        string

        Container name to apply this transformation to.
      • spec.kubernetesPods.containers.parser

        object

        Parser configuration (defines how to unpack the original log line).

        Semantics:

        • parsing is best-effort (errors/mismatches do not drop events)
        • first successful pattern wins (for Regex/Grok)
        • named captures are written into .parsed_data
        • spec.kubernetesPods.containers.parser.grok

          object

          Grok parser configuration. Named fields are saved into .parsed_data.
          • spec.kubernetesPods.containers.parser.grok.customPatterns

            array of objects

            Custom grok pattern definitions (name -> regex). These are added to the built-in grok patterns.
            • spec.kubernetesPods.containers.parser.grok.customPatterns.key

              string
            • spec.kubernetesPods.containers.parser.grok.customPatterns.value

              string
          • spec.kubernetesPods.containers.parser.grok.patterns

            array of strings

            Required value

            Grok patterns to try in order. The first successfully matched pattern wins.
        • spec.kubernetesPods.containers.parser.regex

          object

          Regex parser configuration. Only named capture groups are saved into .parsed_data.
          • spec.kubernetesPods.containers.parser.regex.patterns

            array of strings

            Required value

            Regex patterns to try in order. The first successfully matched pattern wins.
        • spec.kubernetesPods.containers.parser.type

          string

          Required value

          Parser type.

          • JSON: parse the original log line as JSON (parse_json()).
          • Regex: apply regex patterns and extract named capture groups.
          • Grok: apply grok patterns and extract named fields.

          Allowed values: JSON, Regex, Grok

    • spec.kubernetesPods.labelSelector

      object

      Required value

      Pod label selector.
      • spec.kubernetesPods.labelSelector.matchExpressions

        array of objects

        List of label selector requirements.
        • spec.kubernetesPods.labelSelector.matchExpressions.key

          string
        • spec.kubernetesPods.labelSelector.matchExpressions.operator

          string

          Allowed values: In, NotIn, Exists, DoesNotExist

        • spec.kubernetesPods.labelSelector.matchExpressions.values

          array of strings
      • spec.kubernetesPods.labelSelector.matchLabels

        object

        Map of label key to value.
    • spec.kubernetesPods.namespaceSelector

      object

      Namespace selection (subset of ClusterLoggingConfig). Only matchNames/excludeNames are supported.
      • spec.kubernetesPods.namespaceSelector.excludeNames

        array of strings
      • spec.kubernetesPods.namespaceSelector.matchNames

        array of strings
  • spec.type

    string

    Required value

    Input type the rules apply to. KubernetesPods — match pod/container logs. File — match node file logs.

    Allowed values: KubernetesPods, File

• status

  object

  Current status of this resource.
  • status.conditions

    array of objects

    Represents the latest available observations of an object’s state.
    • status.conditions.lastTransitionTime

      string
    • status.conditions.message

      string

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer
    • status.conditions.reason

      string

      Length: 1..1024

    • status.conditions.status

      string

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Maximum length: 316

  • status.observedGeneration

    integer

    The generation observed by the controller.

ClusterSecurityEventShipper

Short names: cses

Scope: Cluster
Version: v1alpha1

• spec

  array of objects

  Cluster-wide pipelines for extracting security events from node files or pod logs. Each pipeline item describes the source and one or more event definitions (produces).
  • spec.input

    object
    • spec.input.files

      array of strings

      Node file paths (required for type File).
    • spec.input.kubernetesPods

      object

      Pod selection for cluster-wide collection.
      • spec.input.kubernetesPods.labelSelector

        object

        Required value

        Kubernetes-style label selector.
        • spec.input.kubernetesPods.labelSelector.matchExpressions

          array of objects

          List of label selector requirements.
          • spec.input.kubernetesPods.labelSelector.matchExpressions.key

            string
          • spec.input.kubernetesPods.labelSelector.matchExpressions.operator

            string

            Allowed values: In, NotIn, Exists, DoesNotExist

          • spec.input.kubernetesPods.labelSelector.matchExpressions.values

            array of strings
        • spec.input.kubernetesPods.labelSelector.matchLabels

          object

          Map of label key to value.
      • spec.input.kubernetesPods.namespace

        string

        Namespace to collect pod logs from (legacy exact namespace match).
      • spec.input.kubernetesPods.namespaceSelector

        object

        Namespace selector for cluster pod log collection.

        • If matchNames is set, only these namespaces are included.
        • If excludeNames is set, these namespaces are excluded.
        • If both are empty, all namespaces are matched.
        • spec.input.kubernetesPods.namespaceSelector.excludeNames

          array of strings

          Explicitly excluded namespace names.
        • spec.input.kubernetesPods.namespaceSelector.matchNames

          array of strings

          Explicitly included namespace names.
    • spec.input.type

      string

      Required value

      File — read from node files. KubernetesPods — read from pod logs (cluster-wide; labelSelector required; namespace or namespaceSelector optional).

      Allowed values: File, KubernetesPods

  • spec.parser

    array of objects

    Parser rules for best-effort parsing of raw log line .message into .parsed_data.

    • For input.type: KubernetesPods: this repeats SecurityEventLoggingTransformationRules.spec.containers[]. Match is performed by .namespace + .container + .pod_labels.
    • For input.type: File: set name: file and the rule will be applied when .file matches one of input.files.

    Container selection happens on the log-shipper side via labelFilter.

    • spec.parser.drop_raw

      boolean

      If true, removes the original raw message field after parsing.

      Default: false

    • spec.parser.fields

      array of objects

      Optional field type conversions applied after parsing.
      • spec.parser.fields.name

        string

        Field name in the parsed object.
      • spec.parser.fields.type

        string

        Target field type.

        Allowed values: String, Int, Float, Bool

    • spec.parser.name

      string

      Container name (or file for file input).
    • spec.parser.parser

      object

      Parser configuration.
      • spec.parser.parser.grok

        object
        • spec.parser.parser.grok.customPatterns

          array of objects
          • spec.parser.parser.grok.customPatterns.key

            string
          • spec.parser.parser.grok.customPatterns.value

            string
        • spec.parser.parser.grok.patterns

          array of strings

          Required value
      • spec.parser.parser.regex

        object
        • spec.parser.parser.regex.patterns

          array of strings

          Required value
      • spec.parser.parser.type

        string

        Required value

        Parser type.

        Allowed values: JSON, Regex, Grok

  • spec.parserRef

    string

    Name of ClusterSecurityEventLoggingTransformationRules (CSELTR) object to use as parser rule source.

    Used only when parser is not set.

  • spec.produces

    array of objects

    List of produced security events for this source.
    • spec.produces.enrich

      array of objects

      Enrichment rules for adding extra fields into outgoing SecurityEvent.

      Each rule writes into a destination field path (target). Sources:

      • Static: write a literal string from value.
      • Plugin: resolve a field at runtime via HTTP lookup to the enrichment-cache sidecar (in-memory Pod/NodeUser cache, no API server call per event). Plugins:
        • k8s-pod-info, k8s-container-info: resolve Pod fields. Supports two lookup modes:
          • Pod-name mode: args pod_name + namespace.
          • Container-ID mode: arg container_id (resolves namespace, name, or serviceAccountName from the container runtime ID).
        • k8s-nodeuser-info: resolve a static-user username (nodeusers.deckhouse.io) by uid. Arg uid (resolves the NodeUser metadata.name matching spec.uid).

      Enrich rules are applied after transform, so they override transform when targeting the same field.

      • spec.produces.enrich.args

        array of objects

        Plugin arguments as key/value pairs. The key must match an arg name declared by the referenced ClusterSecurityEventEnrichmentPlugin CR (spec.args[].name). The value is a dot-path in the event resolved with the same logic as transform rules: a @root. prefix reads from the event root, otherwise the value is read from .parsed_data.

        At runtime, each arg becomes a query parameter sent to the plugin endpoint: GET <endpoint>?<arg1>=<val1>&<arg2>=<val2>.

        For built-in plugins:

        • k8s-pod-info: pod_name + namespace (both required).
        • k8s-container-info: container_id (required; runtime prefixes like containerd:// are stripped automatically).
        • k8s-nodeuser-info: uid (required; system UID from the event).
        • spec.produces.enrich.args.key

          string
        • spec.produces.enrich.args.value

          string
      • spec.produces.enrich.plugin

        string

        Plugin name (required for source=Plugin). References an existing ClusterSecurityEventEnrichmentPlugin CR by its metadata.name.

        Built-in Internal plugins shipped with the module:

        • k8s-pod-info — resolve Pod fields by pod name + namespace.
        • k8s-container-info — resolve Pod fields by container runtime ID.
        • k8s-nodeuser-info — resolve static-user username (nodeusers.deckhouse.io) by uid.

        Users can create External ClusterSecurityEventEnrichmentPlugin CRs to register custom enrichment endpoints.

      • spec.produces.enrich.source

        string

        Enrichment source type.

        Allowed values: Static, Plugin

      • spec.produces.enrich.target

        string

        Destination field path in outgoing SecurityEvent (dot-separated).
      • spec.produces.enrich.value

        string

        For Static source: literal string to be written to target.

        For Plugin source: the response field to extract from the plugin’s JSON response. Must match one of the returns.fields[].name declared by the referenced ClusterSecurityEventEnrichmentPlugin CR. For example: serviceAccountName, name, namespace (k8s-pod-info / k8s-container-info), username (k8s-nodeuser-info).

    • spec.produces.eventCode

      string

      Event code (references SecurityEventDefinition.spec.code).
    • spec.produces.extract

      object

      Detection rule for this produced event.

      This structure maps 1:1 into log-shipper ClusterLoggingConfig.spec.labelFilter item.

      Notes:

      • values is required for In, NotIn, Regex, NotRegex.
      • values must be omitted/empty for Exists, DoesNotExist.

      Allowed field values are message plus log-shipper metadata labels. Kubernetes: pod, namespace, pod_labels, pod_ip, image, container, node, pod_owner, node_group. File: host, host_ip, file.

      • spec.produces.extract.field

        string

        Required value

        Field name for filtering (same as ClusterLoggingConfig labelFilter.field). Typical values: message, file, namespace.
      • spec.produces.extract.operator

        string

        Required value

        Operator for field comparison (same as ClusterLoggingConfig labelFilter.operator).

        Allowed values: In, NotIn, Regex, NotRegex, Exists, DoesNotExist

      • spec.produces.extract.values

        array of strings

        Array of values or regexes for corresponding operations (same as ClusterLoggingConfig labelFilter.values).
    • spec.produces.transform

      array of objects

      Field mapping for transforming parsed raw logs into outgoing SecurityEvent.

      Keys are destination field paths in the outgoing event (dot-separated). Values are source field paths inside the parsed raw object (dot-separated, relative to .parsed_data). To read from root-level fields, use the @root. prefix (for example: metadata.extra.host_ip: @root.host_ip).

      Example: pod.name: pod_name will copy .parsed_data.pod_name into .pod.name.

      • spec.produces.transform.key

        string
      • spec.produces.transform.value

        string
  • spec.producesDefaults

    object

    Default mappings applied to all items in produces[] of this pipeline item.

    Precedence:

    • transform: keys are merged; defaults first, then produces[].transform overwrites.
    • enrich: used only when produces[].enrich is omitted.
    • spec.producesDefaults.enrich

      array of objects

      Default enrich rules (see produces[].enrich).
      • spec.producesDefaults.enrich.args

        array of objects

        Plugin arguments as key/value pairs. The key must match an arg name declared by the referenced ClusterSecurityEventEnrichmentPlugin CR (spec.args[].name). The value is a dot-path in the event resolved with the same logic as transform rules: a @root. prefix reads from the event root, otherwise the value is read from .parsed_data.

        At runtime, each arg becomes a query parameter sent to the plugin endpoint: GET <endpoint>?<arg1>=<val1>&<arg2>=<val2>.

        For built-in plugins:

        • k8s-pod-info: pod_name + namespace (both required).
        • k8s-container-info: container_id (required; runtime prefixes like containerd:// are stripped automatically).
        • k8s-nodeuser-info: uid (required; system UID from the event).
        • spec.producesDefaults.enrich.args.key

          string
        • spec.producesDefaults.enrich.args.value

          string
      • spec.producesDefaults.enrich.plugin

        string

        Plugin name (required for source=Plugin). References an existing ClusterSecurityEventEnrichmentPlugin CR by its metadata.name.

        Built-in Internal plugins shipped with the module:

        • k8s-pod-info — resolve Pod fields by pod name + namespace.
        • k8s-container-info — resolve Pod fields by container runtime ID.
        • k8s-nodeuser-info — resolve static-user username (nodeusers.deckhouse.io) by uid.

        Users can create External ClusterSecurityEventEnrichmentPlugin CRs to register custom enrichment endpoints.

      • spec.producesDefaults.enrich.source

        string

        Enrichment source type.

        Allowed values: Static, Plugin

      • spec.producesDefaults.enrich.target

        string

        Destination field path in outgoing SecurityEvent (dot-separated).
      • spec.producesDefaults.enrich.value

        string

        For Static source: literal string to be written to target.

        For Plugin source: the response field to extract from the plugin’s JSON response. Must match one of the returns.fields[].name declared by the referenced ClusterSecurityEventEnrichmentPlugin CR. For example: serviceAccountName, name, namespace (k8s-pod-info / k8s-container-info), username (k8s-nodeuser-info).

    • spec.producesDefaults.transform

      array of objects

      Default field mapping (see produces[].transform).
      • spec.producesDefaults.transform.key

        string
      • spec.producesDefaults.transform.value

        string
  • spec.source

    string

    Source identifier (used for enable/disable via ClusterSecurityEventConfig).
• status

  object

  Current status of this resource.
  • status.conditions

    array of objects

    Represents the latest available observations of an object’s state.
    • status.conditions.lastTransitionTime

      string
    • status.conditions.message

      string

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer
    • status.conditions.reason

      string

      Length: 1..1024

    • status.conditions.status

      string

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Maximum length: 316

  • status.observedGeneration

    integer

    The generation observed by the controller.

PodSecurityEventShipper

Short names: pses

Scope: Namespaced
Version: v1alpha1

• spec

  array of objects

  Namespaced pipelines for extracting security events from pod logs of this namespace. Namespace is implied and equals the PodSecurityEventShipper namespace.
  • spec.input

    object
    • spec.input.kubernetesPods

      object

      Required value
      • spec.input.kubernetesPods.labelSelector

        object

        Required value

        Kubernetes-style label selector.
        • spec.input.kubernetesPods.labelSelector.matchExpressions

          array of objects

          List of label selector requirements.
          • spec.input.kubernetesPods.labelSelector.matchExpressions.key

            string
          • spec.input.kubernetesPods.labelSelector.matchExpressions.operator

            string

            Allowed values: In, NotIn, Exists, DoesNotExist

          • spec.input.kubernetesPods.labelSelector.matchExpressions.values

            array of strings
        • spec.input.kubernetesPods.labelSelector.matchLabels

          object

          Map of label key to value.
    • spec.input.type

      string

      Required value

      Allowed values: KubernetesPods

  • spec.parser

    array of objects

    Parser rules (same shape as SecurityEventLoggingTransformationRules.spec.containers[]). Used by the gateway for best-effort parsing of raw logs .message into .parsed_data before applying transform mappings. Note: container is selected by log-shipper via labelFilter; name is the container name these rules apply to.
    • spec.parser.drop_raw

      boolean

      If true, removes the original raw message field after parsing.

      Default: false

    • spec.parser.fields

      array of objects

      Optional field type conversions applied after parsing.
      • spec.parser.fields.name

        string

        Field name in the parsed object.
      • spec.parser.fields.type

        string

        Target field type.

        Allowed values: String, Int, Float, Bool

    • spec.parser.name

      string

      Container name.
    • spec.parser.parser

      object

      Parser configuration.
      • spec.parser.parser.grok

        object

        Grok parser configuration.
        • spec.parser.parser.grok.customPatterns

          array of objects

          Custom grok pattern definitions (name -> regex).
          • spec.parser.parser.grok.customPatterns.key

            string
          • spec.parser.parser.grok.customPatterns.value

            string
        • spec.parser.parser.grok.patterns

          array of strings

          Required value

          Grok patterns to try in order.
      • spec.parser.parser.regex

        object

        Regex parser configuration.
        • spec.parser.parser.regex.patterns

          array of strings

          Required value

          Regex patterns to try in order.
      • spec.parser.parser.type

        string

        Required value

        Parser type.

        • JSON: parse the original log line as JSON.
        • Regex: apply regex patterns and extract named capture groups.
        • Grok: apply grok patterns and extract named fields.

        Allowed values: JSON, Regex, Grok

  • spec.parserRef

    string

    Name of SecurityEventLoggingTransformationRules (SELTR) resource in the same namespace to use as parser rules. Used only when parser is not set.
  • spec.produces

    array of objects

    List of produced security events for this source.
    • spec.produces.enrich

      array of objects

      Enrichment rules for adding extra fields into outgoing SecurityEvent.

      Each rule writes into a destination field path (target). Sources:

      • Static: write a literal string from value.
      • Plugin: resolve a field at runtime via HTTP lookup to the enrichment-cache sidecar (in-memory Pod/NodeUser cache, no API server call per event). Plugins:
        • k8s-pod-info, k8s-container-info: resolve Pod fields. Supports two lookup modes:
          • Pod-name mode: args pod_name + namespace.
          • Container-ID mode: arg container_id (resolves namespace, name, or serviceAccountName from the container runtime ID).
        • k8s-nodeuser-info: resolve a static-user username (nodeusers.deckhouse.io) by uid. Arg uid (resolves the NodeUser metadata.name matching spec.uid).

      Enrich rules are applied after transform, so they override transform when targeting the same field.

      • spec.produces.enrich.args

        array of objects

        Plugin arguments as key/value pairs. The key must match an arg name declared by the referenced ClusterSecurityEventEnrichmentPlugin CR (spec.args[].name). The value is a dot-path in the event resolved with the same logic as transform rules: a @root. prefix reads from the event root, otherwise the value is read from .parsed_data.

        At runtime, each arg becomes a query parameter sent to the plugin endpoint: GET <endpoint>?<arg1>=<val1>&<arg2>=<val2>.

        For built-in plugins:

        • k8s-pod-info: pod_name + namespace (both required).
        • k8s-container-info: container_id (required; runtime prefixes like containerd:// are stripped automatically).
        • k8s-nodeuser-info: uid (required; system UID from the event).
        • spec.produces.enrich.args.key

          string
        • spec.produces.enrich.args.value

          string
      • spec.produces.enrich.plugin

        string

        Plugin name (required for source=Plugin). References an existing ClusterSecurityEventEnrichmentPlugin CR by its metadata.name.

        Built-in Internal plugins shipped with the module:

        • k8s-pod-info — resolve Pod fields by pod name + namespace.
        • k8s-container-info — resolve Pod fields by container runtime ID.
        • k8s-nodeuser-info — resolve static-user username (nodeusers.deckhouse.io) by uid.

        Users can create External ClusterSecurityEventEnrichmentPlugin CRs to register custom enrichment endpoints.

      • spec.produces.enrich.source

        string

        Enrichment source type.

        Allowed values: Static, Plugin

      • spec.produces.enrich.target

        string

        Destination field path in outgoing SecurityEvent (dot-separated).
      • spec.produces.enrich.value

        string

        For Static source: literal string to be written to target.

        For Plugin source: the response field to extract from the plugin’s JSON response. Must match one of the returns.fields[].name declared by the referenced ClusterSecurityEventEnrichmentPlugin CR. For example: serviceAccountName, name, namespace (k8s-pod-info / k8s-container-info), username (k8s-nodeuser-info).

    • spec.produces.eventCode

      string

      Event code (references SecurityEventDefinition.spec.code).
    • spec.produces.extract

      object

      Detection rule for this produced event.

      This structure maps 1:1 into log-shipper PodLoggingConfig.spec.labelFilter item.

      Notes:

      • values is required for In, NotIn, Regex, NotRegex.
      • values must be omitted/empty for Exists, DoesNotExist.

      Allowed field values are message plus log-shipper metadata labels. Kubernetes: pod, namespace, pod_labels, pod_ip, image, container, node, pod_owner, node_group. File: host, host_ip, file.

      • spec.produces.extract.field

        string

        Required value

        Field name for filtering (same as PodLoggingConfig labelFilter.field). Typical values: message, container, namespace.
      • spec.produces.extract.operator

        string

        Required value

        Operator for field comparison (same as PodLoggingConfig labelFilter.operator).

        Allowed values: In, NotIn, Regex, NotRegex, Exists, DoesNotExist

      • spec.produces.extract.values

        array of strings

        Array of values or regexes for corresponding operations (same as PodLoggingConfig labelFilter.values).
    • spec.produces.transform

      array of objects

      Field mapping for transforming parsed raw logs into outgoing SecurityEvent.

      Keys are destination field paths in the outgoing event (dot-separated). Values are source field paths inside the parsed raw object (dot-separated, relative to .parsed_data). To read from root-level fields, use the @root. prefix (for example: metadata.extra.host_ip: @root.host_ip).

      Example: pod.name: pod_name will copy .parsed_data.pod_name into .pod.name.

      • spec.produces.transform.key

        string
      • spec.produces.transform.value

        string
  • spec.producesDefaults

    object

    Default mappings applied to all items in produces[] of this pipeline item.

    Precedence:

    • transform: keys are merged; defaults first, then produces[].transform overwrites.
    • enrich: used only when produces[].enrich is omitted.
    • spec.producesDefaults.enrich

      array of objects

      Default enrich rules (see produces[].enrich).
      • spec.producesDefaults.enrich.args

        array of objects

        Plugin arguments as key/value pairs. The key must match an arg name declared by the referenced ClusterSecurityEventEnrichmentPlugin CR (spec.args[].name). The value is a dot-path in the event resolved with the same logic as transform rules: a @root. prefix reads from the event root, otherwise the value is read from .parsed_data.

        At runtime, each arg becomes a query parameter sent to the plugin endpoint: GET <endpoint>?<arg1>=<val1>&<arg2>=<val2>.

        For built-in plugins:

        • k8s-pod-info: pod_name + namespace (both required).
        • k8s-container-info: container_id (required; runtime prefixes like containerd:// are stripped automatically).
        • k8s-nodeuser-info: uid (required; system UID from the event).
        • spec.producesDefaults.enrich.args.key

          string
        • spec.producesDefaults.enrich.args.value

          string
      • spec.producesDefaults.enrich.plugin

        string

        Plugin name (required for source=Plugin). References an existing ClusterSecurityEventEnrichmentPlugin CR by its metadata.name.

        Built-in Internal plugins shipped with the module:

        • k8s-pod-info — resolve Pod fields by pod name + namespace.
        • k8s-container-info — resolve Pod fields by container runtime ID.
        • k8s-nodeuser-info — resolve static-user username (nodeusers.deckhouse.io) by uid.

        Users can create External ClusterSecurityEventEnrichmentPlugin CRs to register custom enrichment endpoints.

      • spec.producesDefaults.enrich.source

        string

        Enrichment source type.

        Allowed values: Static, Plugin

      • spec.producesDefaults.enrich.target

        string

        Destination field path in outgoing SecurityEvent (dot-separated).
      • spec.producesDefaults.enrich.value

        string

        For Static source: literal string to be written to target.

        For Plugin source: the response field to extract from the plugin’s JSON response. Must match one of the returns.fields[].name declared by the referenced ClusterSecurityEventEnrichmentPlugin CR. For example: serviceAccountName, name, namespace (k8s-pod-info / k8s-container-info), username (k8s-nodeuser-info).

    • spec.producesDefaults.transform

      array of objects

      Default field mapping (see produces[].transform).
      • spec.producesDefaults.transform.key

        string
      • spec.producesDefaults.transform.value

        string
  • spec.source

    string

    Source identifier (used for enable/disable via ClusterSecurityEventConfig).
• status

  object

  Current status of this resource.
  • status.conditions

    array of objects

    Represents the latest available observations of an object’s state.
    • status.conditions.lastTransitionTime

      string
    • status.conditions.message

      string

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer
    • status.conditions.reason

      string

      Length: 1..1024

    • status.conditions.status

      string

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Maximum length: 316

  • status.observedGeneration

    integer

    The generation observed by the controller.

SecurityEvent

Scope: Cluster
Version: v1

• actor

  object

  Actor (subject) that performed the action.
  • actor.id

    string

    Actor identifier.
  • actor.type

    string

    Actor type.

    Allowed values: User, ServiceAccount, System

• event

  object

  Event classification and details.
  • event.category

    string

    Required value

    Event category.

    Allowed values: Auth, Rbac, Runtime, Network, Config

  • event.code

    string

    Required value

    Event code.
  • event.description

    string

    Human-readable event description.
  • event.outcome

    string

    Required value

    Event outcome.

    Allowed values: Success, Failure, Denied

  • event.severity

    string

    Required value

    Event severity.

    Allowed values: Low, Medium, High, Critical

• eventMetadata

  object

  Additional metadata.
  • eventMetadata.cluster

    string

    Required value

    Cluster identifier.
  • eventMetadata.extra

    array of objects

    Extra key-value metadata.
    • eventMetadata.extra.key

      string
    • eventMetadata.extra.value

      string
  • eventMetadata.node

    string

    Node name.
• id

  string

  Unique event identifier.
• object

  object

  Object the event is related to.
  • object.name

    string

    Object name.
  • object.namespace

    string

    Object namespace.
  • object.type

    string

    Object type.
• source

  object

  Source identification for the event.
  • source.component

    string

    Required value

    Component name (e.g. kube-apiserver).
  • source.instance

    string

    Optional instance identifier.
• timestamp

  string

  Event timestamp.

SecurityEventDefinition

Short names: sed

Scope: Cluster
Version: v1alpha1

• spec

  object

  Describes a possible security event.
  • spec.category

    string

    Required value

    Event category.

    Allowed values: Auth, Rbac, Runtime, Network, Config

  • spec.code

    string

    Required value

    Event code.
  • spec.description

    string

    Required value

    Human-readable description.
  • spec.descriptionRu

    string

    Human-readable description in Russian.
  • spec.fields

    array of objects

    List of fields that the event may contain.
    • spec.fields.name

      string

      Field name.
    • spec.fields.required

      boolean

      Whether the field is required.

      Default: true

  • spec.metadata

    object

    Metadata related to the rule
  • spec.severity

    string

    Required value

    Event severity.

    Allowed values: Low, Medium, High, Critical

  • spec.source

    string

    Required value

    Source identifier.
• status

  object

  Current status of this resource.
  • status.conditions

    array of objects

    Represents the latest available observations of an object’s state.
    • status.conditions.lastTransitionTime

      string
    • status.conditions.message

      string

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer
    • status.conditions.reason

      string

      Length: 1..1024

    • status.conditions.status

      string

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Maximum length: 316

  • status.observedGeneration

    integer

    The generation observed by the controller.

SecurityEventLoggingTransformationRules

Short names: seltr

Scope: Namespaced
Version: v1alpha1

• spec

  object

  Namespaced rules to transform raw log lines into structured objects (Vector events) before further processing.
  • spec.containers

    array of objects

    Required value

    Per-container transformation rules.
    • spec.containers.drop_raw

      boolean

      If true, removes the original raw message field after parsing.

      Default: false

    • spec.containers.fields

      array of objects

      Optional field type conversions applied after parsing. Useful to enforce stable types for sinks (Elasticsearch/ClickHouse/etc.).
      • spec.containers.fields.name

        string

        Field name in the parsed object.
      • spec.containers.fields.type

        string

        Target field type.

        Allowed values: String, Int, Float, Bool

    • spec.containers.name

      string

      Container name to apply this transformation to.
    • spec.containers.parser

      object

      Parser configuration (defines how to unpack the original log line).

      Semantics:

      • parsing is best-effort (errors/mismatches do not drop events)
      • first successful pattern wins (for Regex/Grok)
      • named captures are written into .parsed_data
      • spec.containers.parser.grok

        object

        Grok parser configuration. Named fields are saved into .parsed_data.
        • spec.containers.parser.grok.customPatterns

          array of objects

          Custom grok pattern definitions (name -> regex). These are added to the built-in grok patterns.
          • spec.containers.parser.grok.customPatterns.key

            string
          • spec.containers.parser.grok.customPatterns.value

            string
        • spec.containers.parser.grok.patterns

          array of strings

          Required value

          Grok patterns to try in order. The first successfully matched pattern wins.
      • spec.containers.parser.regex

        object

        Regex parser configuration. Only named capture groups are saved into .parsed_data.
        • spec.containers.parser.regex.patterns

          array of strings

          Required value

          Regex patterns to try in order. The first successfully matched pattern wins.
      • spec.containers.parser.type

        string

        Required value

        Parser type.

        • JSON: parse the original log line as JSON (parse_json()).
        • Regex: apply regex patterns and extract named capture groups.
        • Grok: apply grok patterns and extract named fields.

        Allowed values: JSON, Regex, Grok

  • spec.selector

    object

    Required value

    Pod label selector.
    • spec.selector.matchExpressions

      array of objects

      List of label selector requirements.
      • spec.selector.matchExpressions.key

        string
      • spec.selector.matchExpressions.operator

        string

        Allowed values: In, NotIn, Exists, DoesNotExist

      • spec.selector.matchExpressions.values

        array of strings
    • spec.selector.matchLabels

      object

      Map of label key to value.
• status

  object

  Current status of this resource.
  • status.conditions

    array of objects

    Represents the latest available observations of an object’s state.
    • status.conditions.lastTransitionTime

      string
    • status.conditions.message

      string

      Maximum length: 32768

    • status.conditions.observedGeneration

      integer
    • status.conditions.reason

      string

      Length: 1..1024

    • status.conditions.status

      string

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Maximum length: 316

  • status.observedGeneration

    integer

    The generation observed by the controller.