Create a new custom detection rule ↗

The operating system targeted by the rule. The available options are:

• Linux
• Windows

Use Rego to define the custom detection logic.

Use the default code in this box as a reference or starting point. Click read here for more information how to use Rego syntax.

Example 1

Code
"/var/log/auth.log":
{
"content": "Failed password for invalid user test from 192.168.1.1 port 22 ssh2\n",
"metadata":
{
"file_type": "file",
"gid": 1000,
"last_modified": 1737292449,
"permissions": 436,
"size": 6000,
"uid": 1001
},"path": "/var/log/auth.log"
}
Script
package
panw.complianceimport rego.v1
match contains {"msg": msg}
if {
authLogFile = input["/var/log/auth.log"
]
contains(authLogFile.content, "Failed password")
authLogFile.metadata.permissions == 436
authLogFile.metadata.size > 5000
msg := "Failed login attempts detected in /var/log/auth.log"}
Output
"match": [
{
"msg": "Failed login attempts detected in /var/log/auth.log"
},
]

Example 2

Code
"/etc/passwd":
{
"content": "root0:0:root:/root:/bin/bash\nuser1:*:1001:1001:User One:/home/user1:/bin/bash\n",
"metadata": {
"file_type": "file",
"gid": 1001,
"last_modified": 1737292449,
"permissions": 644,
"size": 100,
"uid": 1002
},"path": "/etc/passwd"
}
Script
package
panw.complianceimport rego.v1
match contains {"msg": msg}
if {
passwdFile = input["/etc/passwd"]
passwdFile.metadata.file_type == "file"
passwdFile.metadata.permissions == 644
passwdFile.metadata.size < 200
contains(passwdFile.content, ":*:")
msg := "Empty or suspicious password detected in /etc/passwd"}
Output
"match": [
{
"msg": "Empty or suspicious password detected in /etc/passwd"
},
]

Example 3

Code
"/etc/shadow": {
"content": "root:$6$abc123$abc123abc123abc123abc123abc123abc123abc123abc123abc123abc123abc123abc123abc123abc123abc123:17542:0:99999:7:::",
"metadata": {
"file_type": "file",
"gid": 1001,
"last_modified": 1737292449,
"permissions": 640,
"size": 100,
"uid": 1002
},"path": "/etc/shadow"
}
Script
package
panw.complianceimport rego.v1
match contains {"msg": msg} if {
shadowFile = input["/etc/shadow"]
shadowFile.metadata.file_type == "file"
shadowFile.metadata.permissions != 600
shadowFile.metadata.size > 30
contains(shadowFile.content, "::")
msg := "Empty or weak password detected in /etc/shadow"}
Output
"match": [
{
"msg": "Empty or weak password detected in /etc/shadow"
},
]

From the drop down, select one or more from the following:

• Namespaces: Logical partitions within a Kubernetes cluster that allow resource isolation and organization.
• ReplicaSets: Ensures a specified number of pod replicas are running at all times by automatically scaling up or down.
• Deployments: Manages and control pod replicas by providing declarative updates for ReplicaSets, enabling rolling updates and rollbacks.
• StatefulSets: Deploys stateful applications that require persistent identity and storage, ensuring stable pod names and ordered scaling.
• DaemonSets: Ensures that a copy of a specific pod runs on all or selected nodes in the cluster, commonly used for logging and monitoring agents.
• Jobs: Runs one-time or short-lived workloads that complete execution and then terminate.
• CronJobs: Defines scheduled jobs that run at specified times or intervals, similar to Linux cron jobs.
• ClusterRoles: Defines permissions at the cluster level, granting access to resources across all namespaces.
• Roles: Defines permissions within a specific namespace, restricting access to resources within that namespace.
• RoleBindings: Associates a role with a user, group, or service account within a specific namespace.
• ClusterRoleBindings: Associates a cluster role with users, groups, or service accounts at the cluster-wide level.
• NetworkPolicies: Defines rules that control the communication between pods and other network entities within the cluster, enforcing security restrictions.
• Services: Exposes a set of pods as a network service, allowing stable communication within and outside the cluster.
• ServiceAccounts: Provides an identity for pods to authenticate against the Kubernetes API, allowing controlled access to resources.
• Endpoints: Represents the actual network addresses of the pods backing a service, dynamically updated as pods start or stop.
• Ingresses: Manages external access to services, providing HTTP/HTTPS routing, load balancing, and SSL termination.
• ConfigMaps: Stores non-sensitive configuration data in key-value pairs, allowing applications to retrieve configuration without modifying container images.
• Secrets: Securely stores and manage sensitive data, such as API keys, passwords, and certificates, in an encrypted format.
• Nodes: Defines the physical or virtual machines that run the workloads in a Kubernetes cluster.

All custom Rego policies in Cortex must follow this pattern:

package panw.compliance
import rego.v1
match contains {"msg": msg} if {
# Your detection logic here
msg := "Description of the finding"
}