Sysdig Response Actions (v2.0.1)
This is an integration that will use Sysdig agent to respond to malicious activity by triggering different actions at the host or container level like killing a container, quarantine a file or perform a system capture
- Author
- Sysdig
- Support
- partner
- URL
- https://sysdig.com/support/
- Default data source
- SysdigResponseActions
- Categories
- Data Enrichment & Threat Intelligence
Incident fields (37)
- Sysdig AWS Account ID
- Sysdig AWS Instance ID
- Sysdig AWS Region
- Sysdig Agent ID
- Sysdig Agent Variant
- Sysdig Agent Version
- Sysdig Aggregated
- Sysdig Container ID
- Sysdig Container Image
- Sysdig Container Image ID
- Sysdig Container Image Tag
- Sysdig Container Name
- Sysdig Customer ID
- Sysdig Event ID
- Sysdig Event Type
- Sysdig Event URL
- Sysdig Falco Output
- Sysdig Host ID
- Sysdig K8s Cluster Name
- Sysdig K8s Namespace
- Sysdig K8s Node Name
- Sysdig K8s Pod Name
- Sysdig K8s Workload Name
- Sysdig K8s Workload Type
- Sysdig Origin
- Sysdig Policy ID
- Sysdig Policy Name
- Sysdig Policy Version
- Sysdig Process CWD
- Sysdig Process Cmdline
- Sysdig Process Name
- Sysdig Process Parent Name
- Sysdig Process SHA256
- Sysdig Rule Name
- Sysdig Rule Type
- Sysdig Source
- Sysdig Username
Integrations (1)
- Sysdig Response Actions
Layouts (1)
- Sysdig Incident
README
Sysdig Response Actions
This integration utilizes the Sysdig agent and the Sysdig Response Actions API to facilitate automated and manual remediation of security incidents. It enables security teams to take precise actions at the host or container level, such as terminating compromised containers, quarantining suspicious files, or capturing detailed system activity for forensic analysis. These capabilities are designed to enhance incident response workflows and improve overall security operations.
What does this pack do?
This pack leverages the Sysdig Response Actions API to enable automated and manual responses to security incidents. Key features include:
- Container Management: Terminate malicious containers to prevent further damage.
- File Quarantine: Isolate suspicious files to mitigate potential threats.
- System Capture: Perform detailed system captures for forensic analysis.
- Host-Level Actions: Execute commands or scripts on hosts to remediate issues.
These capabilities help streamline incident response and enhance security posture.
For more information, visit Sysdig.
