Configuration

Available in: EE

The module lifecycle stage: Experimental

The module has requirements for installation

How to explicitly enable the module…

You may explicitly enable or disable the module in one of the following ways:

Via Deckhouse web UI. In the “System” → “System Management” → “Deckhouse” → “Modules” section, open the security-events-manager module and enable (or disable) the “Module enabled” toggle. Save changes.

Example:
Via Deckhouse CLI (d8).

Use the d8 system module enable command for enabling, or d8 system module disable command for disabling the module (you need Deckhouse CLI (d8), configured to work with the cluster).

Example of enabling the module:
```
d8 system module enable security-events-manager
```
Using ModuleConfig security-events-manager.

Set spec.enabled to true or false in ModuleConfig security-events-manager (create it if necessary);

Example of a manifest to enable module security-events-manager:
```
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: security-events-manager
spec:
  enabled: true
```

How to configure the module…

You can configure the module in one of the following ways:

Via Deckhouse web UI.

In the “System” → “System Management” → “Deckhouse” → “Modules” section, open the security-events-manager module and enable the “Advanced Settings” switch. Fill in the required fields in the “Configuration” tab or specify the module settings in YAML format on the “YAML” tab, excluding the settings section. Save the changes.

Example:

You can also edit the ModuleConfig object security-events-manager on the “YAML” tab in the module settings window (“System” → “System Management” → “Deckhouse” → “Modules”, open the module security-events-manager) by specifying the schema version in the spec.version parameter and the necessary module parameters in the spec.settings section.
Via Deckhouse CLI (d8) (requires Deckhouse CLI (d8) configured to work with the cluster).

Edit the existing ModuleConfig security-events-manager (for more details on configuring Deckhouse, see the documentation) by executing the following command:
```
d8 k edit mc security-events-manager
```
Make the necessary changes in the spec.settings section. If necessary, specify the schema version in the spec.version parameter. Save the changes.

You can also create a file with manifest for ModuleConfig security-events-manager using the example below. Fill in the spec.settings section with the required module parameters. If necessary, specify the schema version in the spec.version parameter.

Apply the manifest using the following command (indicate the manifest file name):
```
d8 k apply -f <FILENAME>
```
Example of a manifest for ModuleConfig security-events-manager:
```
apiVersion: deckhouse.io/v1alpha1
kind: ModuleConfig
metadata:
  name: security-events-manager
spec:
  version: 1
  enabled: true
  settings: # Module parameters from the "Parameters" section below.
```

How to change the module release channel…

To change the module release channel, follow the instruction.

Requirements

To the Deckhouse version: 1.74 and above.

To the versions of other modules:

log-shipper: any version.
loki: any version.

Parameters

Schema version: 1

settings
object
- settings.clusterSecurityEventDestination
  
  object
  Configs for ClusterSecurityEventDestination objects
  - settings.clusterSecurityEventDestination.clusterLoki
    
    boolean
    Whether to generate ClusterSecurityEventDestination for cluster Loki.
    
    Default: true
- settings.controller
  
  object
  Security events controller settings.
  - settings.controller.replicas
    
    integer
    Number of controller replicas.
    
    Default: 1
  - settings.controller.resourcesRequests
    
    object
    Resource request management for controller. When vertical-pod-autoscaler is disabled, static or VPA min values are used as requests.
    - settings.controller.resourcesRequests.mode
      
      string
      
      Default: VPA
      
      Allowed values: VPA, Static
    - settings.controller.resourcesRequests.static
      
      object
      
      Default: {}
      - settings.controller.resourcesRequests.static.cpu
        
        Default: 10m
      - settings.controller.resourcesRequests.static.memory
        
        Default: 64Mi
    - settings.controller.resourcesRequests.vpa
      
      object
      
      Default: {}
      - settings.controller.resourcesRequests.vpa.cpu
        
        object
        
        Default: {}
        
        settings.controller.resourcesRequests.vpa.cpu.max
        
        Default: 100m
        
        settings.controller.resourcesRequests.vpa.cpu.min
        
        Default: 10m
      - settings.controller.resourcesRequests.vpa.memory
        
        object
        
        Default: {}
        
        settings.controller.resourcesRequests.vpa.memory.max
        
        Default: 256Mi
        
        settings.controller.resourcesRequests.vpa.memory.min
        
        Default: 64Mi
      - settings.controller.resourcesRequests.vpa.mode
        
        string
        
        Default: Initial
        
        Allowed values: Initial, Auto
  - settings.controller.vectorValidateTimeout
    
    string
    Timeout for the vector validate run the controller performs before publishing a new gateway Vector config (Go duration string, for example “30s”, “2m”). The controller validates with --no-environment, which takes about 2 seconds for a 256 KB config, so the default leaves a wide margin. If the check cannot be completed within the timeout, the config is published anyway and the gateway reloader validates it instead.
    
    Default: 60s
- settings.gateway
  
  object
  Security events gateway settings.
  - settings.gateway.buffer
    
    object
    Default buffer settings for all gateway Vector sinks. Can be overridden per-destination in ClusterSecurityEventDestination.spec.buffer. Defaults to Disk + Block for zero data loss of security events.
    - settings.gateway.buffer.maxEvents
      
      integer
      Maximum number of events in the buffer. Used as a secondary limit for Memory type. Ignored when type is Disk (disk buffer uses maxSize only).
      
      Default: 500
    - settings.gateway.buffer.maxSize
      
      string
      Maximum size of the buffer as a Kubernetes quantity string with a mandatory unit suffix (e.g. “512Mi”, “1Gi”, “256Mi”). Plain numbers without a unit suffix are NOT accepted. For Disk type: maximum disk space used on the volume. For Memory type: approximate memory limit for the in-memory ring buffer.
      
      Default: 512Mi
      
      Pattern: ^[0-9]+(\.[0-9]+)?(Ki|Mi|Gi|Ti|Pi|Ei|k|M|G|T|P|E)$
    - settings.gateway.buffer.type
      
      string
      Buffer type.
      
      Disk: disk-based buffer using LevelDB. Survives Vector process restarts within the pod. DEFAULT — ensures no security events are lost during temporary destination outages.
      
      Memory: in-memory ring buffer. Faster, but all events are lost on Vector process restart. Use only for test/dev environments.
      
      Default: Disk
      
      Allowed values: Memory, Disk
    - settings.gateway.buffer.whenFull
      
      string
      Behavior when the buffer is full.
      
      Block: apply backpressure to upstream. Pipeline slows down but NO events are lost. DEFAULT — the correct choice for security events.
      
      DropNewest: discard incoming events. Data loss occurs but no backpressure. Use only when data loss is acceptable (test environments).
      
      Default: Block
      
      Allowed values: Block, DropNewest
  - settings.gateway.logShipperBuffer
    
    object
    Buffer settings for the log-shipper ClusterLogDestination that ships events from agents to the gateway. Defaults to Disk + Block for zero data loss on the agent side.
    - settings.gateway.logShipperBuffer.maxEvents
      
      integer
      Maximum number of events in the agent buffer. Used as a secondary limit for Memory type.
      
      Default: 500
    - settings.gateway.logShipperBuffer.maxSize
      
      string
      Maximum size of the agent buffer as a Kubernetes quantity string with a mandatory unit suffix (e.g. “257Mi”, “512Mi”, “1Gi”). Plain numbers without a unit suffix are NOT accepted. Per node agent. Must be at least 268435488 bytes (~256MB) — log-shipper’s disk buffer minimum. A value of exactly “256Mi” (268435456 bytes) is rejected by the agent.
      
      Default: 257Mi
      
      Pattern: ^[0-9]+(\.[0-9]+)?(Ki|Mi|Gi|Ti|Pi|Ei|k|M|G|T|P|E)$
    - settings.gateway.logShipperBuffer.type
      
      string
      Buffer type for the log-shipper agent buffer.
      
      Disk: disk-based buffer. Survives Vector process restarts on the agent node. DEFAULT.
      
      Memory: in-memory ring buffer. Events are lost on agent restart.
      
      Default: Disk
      
      Allowed values: Memory, Disk
    - settings.gateway.logShipperBuffer.whenFull
      
      string
      Behavior when the agent buffer is full.
      
      Block: apply backpressure. NO events are lost. DEFAULT.
      
      DropNewest: discard incoming events. Data loss occurs.
      
      Default: Block
      
      Allowed values: Block, DropNewest
  - settings.gateway.nodeSelector
    
    object
    Node selector for gateway Deployment.
  - settings.gateway.reloaderValidateTimeout
    
    string
    Timeout for vector validate executed by the gateway reloader sidecar (Go duration string, e.g. “45s”, “2m”). Increase this if the gateway vector config is large (many SecurityEventDefinitions × transforms) and vector validate is being killed by the reloader before completing. Range: 5s–5m; invalid values fall back to 120s.
    
    Default: 120s
  - settings.gateway.replicas
    
    integer
    Number of gateway replicas.
    
    Default: 2
  - settings.gateway.resources
    
    object
    Resource requests/limits for gateway pods.
    - settings.gateway.resources.limits
      
      object
      - settings.gateway.resources.limits.cpu
        
        string
      - settings.gateway.resources.limits.memory
        
        string
    - settings.gateway.resources.requests
      
      object
      - settings.gateway.resources.requests.cpu
        
        string
        
        Default: 100m
      - settings.gateway.resources.requests.memory
        
        string
        
        Default: 128Mi
  - settings.gateway.resourcesRequests
    
    object
    Resource request management for gateway (vector container). When vertical-pod-autoscaler is disabled, static or VPA min values are used as requests.
    - settings.gateway.resourcesRequests.mode
      
      string
      
      Default: VPA
      
      Allowed values: VPA, Static
    - settings.gateway.resourcesRequests.static
      
      object
      
      Default: {}
      - settings.gateway.resourcesRequests.static.cpu
        
        Default: 100m
      - settings.gateway.resourcesRequests.static.memory
        
        Default: 128Mi
    - settings.gateway.resourcesRequests.vpa
      
      object
      
      Default: {}
      - settings.gateway.resourcesRequests.vpa.cpu
        
        object
        
        Default: {}
        
        settings.gateway.resourcesRequests.vpa.cpu.max
        
        Default: 3000m
        
        settings.gateway.resourcesRequests.vpa.cpu.min
        
        Default: 100m
      - settings.gateway.resourcesRequests.vpa.memory
        
        object
        
        Default: {}
        
        settings.gateway.resourcesRequests.vpa.memory.max
        
        Default: 4096Mi
        
        settings.gateway.resourcesRequests.vpa.memory.min
        
        Default: 128Mi
      - settings.gateway.resourcesRequests.vpa.mode
        
        string
        
        Default: Initial
        
        Allowed values: Initial, Auto
  - settings.gateway.tolerations
    
    array of objects
    Tolerations for gateway pods.
- settings.securityEventConfig
  
  object
  Default configuration of security alert sources and destination (default resource ClusterSecurityEventConfig). Can be overridden per CR ClusterSecurityEventShipper.
  
  Default: { "destinations": [ "cluster-loki" ], "enabled": true, "sourcesMasks": [ "podSecurityEventShipper/*", "clusterSecurityEventShipper/*" ] }
  - settings.securityEventConfig.cef
    
    object
    Default CEF (Common Event Format) metadata for the generated ClusterSecurityEventConfig. These values populate spec.cef in the default CSEC and are used as fallbacks when a ClusterSecurityEventDestination with encoding.codec=CEF does not specify its own device vendor/product/version.
    - settings.securityEventConfig.cef.deviceProduct
      
      string
      Default device product for CEF header.
      
      Default: security-events-manager
    - settings.securityEventConfig.cef.deviceVendor
      
      string
      Default device vendor for CEF header.
      
      Default: Deckhouse
    - settings.securityEventConfig.cef.deviceVersion
      
      string
      Default device version for CEF header.
      
      Default: 1
  - settings.securityEventConfig.destinations
    
    array of strings
    List of ClusterSecurityEventDestination names.
    
    Default: [ "cluster-loki" ]
  - settings.securityEventConfig.enabled
    
    boolean
    Generate default ClusterSecurityEventConfig.
    
    Default: true
  - settings.securityEventConfig.minimumSeverityThreshold
    
    string
    Minimal severity to ship (inclusive).
    
    Default: Low
    
    Allowed values: Low, Medium, High, Critical
  - settings.securityEventConfig.sources
    
    array of strings
    List of enabled source identifiers (used when sourcesMasks is not set).
  - settings.securityEventConfig.sourcesMasks
    
    array of strings
    List of glob-style masks for enabled sources (e.g. “*” for all). Mutually exclusive with sources. When set, ClusterSecurityEventConfig uses enabledSourcesMasks.

Requirements

Parameters

An error has occurred

Tell us what you didn’t like.

Configuration

Requirements

Parameters

An error has occurred

Tell us what you didn’t like.

Request trial access

Thank you

Error

Request callback

Thank you

Something went wrong

Book your sessions

Thank you

Error

Request demo

Thank you

Error

Get the PCI SSC Compliance Report

Thank you

Error