Skip to content
This repository has been archived by the owner on Jan 10, 2024. It is now read-only.

Latest commit

 

History

History
125 lines (95 loc) · 5.17 KB

jupiterone.md

File metadata and controls

125 lines (95 loc) · 5.17 KB

Sysdig

Sysdig + JupiterOne Integration Benefits

  • Visualize Sysdig account, teams, users and findings in the JupiterOne graph.
  • See relationships between Sysdig teams and users in your JupiterOne account.
  • Monitor changes to Sysdig users using JupiterOne alerts.

How it Works

  • JupiterOne periodically fetches account details, teams, users and findings from Sysdig to update the graph.
  • Write JupiterOne queries to review and monitor updates to the graph, or leverage existing queries.
  • Configure alerts to take action when JupiterOne graph changes, or leverage existing alerts.

Requirements

  • Sysdig supports an API Token credential. You must have a Administrator user account.
  • JupiterOne requires a Sysdig account API token. You need permission to create a user in Sysdig that will be used to obtain the API key.
  • You must have permission in JupiterOne to install new integrations.

Support

If you need help with this integration, please contact JupiterOne Support.

Integration Walkthrough

In Sysdig

  1. Retrieve the Sysdig API Token
  2. Look up the SaaS Region for your Sysdig account. The integration configuration needs the endpoint for your account (e.g. us2)

In JupiterOne

  1. From the top navigation of the J1 Search homepage, select Integrations.
  2. Scroll to the Sysdig integration tile and click it.
  3. Click the Add Configuration button and configure the following settings:
  • Enter the Account Name by which you'd like to identify this Sysdig account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when Tag with Account Name is checked.
  • Enter a Description that will further assist your team when identifying the integration instance.
  • Select a Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.
  • Enter the Sysdig API Token generated for use by JupiterOne.
  • Enter the Region for your Sysdig account
  1. Click Create Configuration once all values are provided.

How to Uninstall

  1. From the top navigation of the J1 Search homepage, select Integrations.
  2. Scroll to the Sysdig integration tile and click it.
  3. Identify and click the integration to delete.
  4. Click the trash can icon.
  5. Click the Remove button to delete the integration.

Data Model

Entities

The following entities are created:

Resources Entity _type Entity _class
Account sysdig_account Account
Agent sysdig_agent Scanner
Cluster sysdig_cluster Cluster
Finding sysdig_finding Finding
Image Scan sysdig_image_scan Assessment
Scanner sysdig_scanner Service
Team sysdig_team Team
User sysdig_user User

Relationships

The following relationships are created:

Source Entity _type Relationship _class Target Entity _type
sysdig_account HAS sysdig_agent
sysdig_account HAS sysdig_cluster
sysdig_account HAS sysdig_image_scan
sysdig_account HAS sysdig_scanner
sysdig_account HAS sysdig_team
sysdig_account HAS sysdig_user
sysdig_agent SCANS sysdig_cluster
sysdig_image_scan IDENTIFIED sysdig_finding
sysdig_scanner PERFORMED sysdig_image_scan
sysdig_team HAS sysdig_user

Mapped Relationships

The following mapped relationships are created:

Source Entity _type Relationship _class Target Entity _type Direction
sysdig_finding IS *cve* FORWARD