SysdigResponseActions

Uses the Sysdig agent to respond to malicious activity by triggering different actions at the host or container level, such as killing a container, quarantining a file, or performing a system capture.

Category

Data Enrichment & Threat Intelligence

Pack

Sysdig

Configuration parameters

• url — Your server URL (required)
• credentials — (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• classifier — Classifier
• mapper — Mapper (incoming)
• isFetch — Fetch incidents
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval
• max_fetch — The maximum number of incidents per fetch
• first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)

Commands (6)

• create-system-capture — Triggers a system capture, recording all system calls at the host level.
• execute-response-action — Executes response actions through the Sysdig API. Each action type requires a specific set of parameters. Use the actionType description to see which parameters are required for each action.
• get-action-execution — Gets the status and information of a triggered action execution.
• get-capture-file — Gets a system capture based on the capture ID.
• sysdig-agent-info-get — Resolves a host MAC address to its Sysdig agent details (agent ID, customer ID, hostname). The result is cached per MAC address.
• sysdig-customer-info-get — Gets the Sysdig customer ID and name. The result is cached per integration instance.