Kaspersky Container Security

CEF format prefix and version

<CEF>:<version>

CEF:0

Unique ID of the event type (Signature ID)

Kaspersky Container Security sends the following event type IDs:

• ADM-ХХХ: Administration event.
• CVE-XXX: Risk acceptance with regard to a vulnerability or expiration of such risk acceptance.
• MLW-XXX: Risk acceptance with regard to a piece of malware or for expiration of such risk acceptance.
• NCMP-001: Non-compliance of an image with requirements.
• CMP-001: Compliance of an image with requirements.
• SD-XXX: Risk acceptance with regard to sensitive data or for expiration of such risk acceptance.
• MS-XXX: Risk acceptance with regard to misconfigurations or for expiration of such risk acceptance.
• CI-ХХХ: Event in the CI/CD process.
• PLC-ХХХ: Event when applying a secuity policy.
• BNCH-ХХХ: Event when scanning the cluster and nodes.
• AG-ХХХ: Event related to an agent.
• SJ-ХХХ: Event of the scanner.
• RT-ХХХ: Event of a best practice check.
• API-ХХХ: Request to API server.
• PM-ХХХ: Event when implementing processes.
• FM-ХХХ: Event involving access to objects in the container file system.
• NT-ХХХ: Network connection.
• FPM-XXX – an event of a runtime policy violation during a process
• FNT-XXX – an event of a runtime policy violation related to a network connection
• FFM-XXX – an event of a runtime policy violation related to an access to objects in the container file system
• FFTP-XXX – an event of a runtime policy violation related to File Threat Protection

Some of the event type IDs sent by the solution:

• ADM-001: User 1 added user 2.
• CVE-001: User 1 accepted risk for image XXX
• AG-002: Agent XXX is disconnected
• BNCH-003: YYY was passed while scanning XXX
• PLC-001: YYY was applied to image XXX
• NCMP-001: Image XXX was marked as non-compliant
• SD-008: XXX risk acceptance expires

Importance of the event (Severity)

The severity of the event on a scale from 0 to 10 is determined as follows:

• 0–3: Low
• 4–6: Medium
• 7–8: High
• 9–10: Very high

The severity score of an event depends on the event type and status (Success or Failure).

For example, the severity score can be determined as follows:

• For PM (Process management) and NT (Networking) events:
  • If event status is Audited or Blocked, the severity is 7.
  • For any other status, the severity is 3.
• For AG (Agents) events:
  • If the event is successful, the severity is 5.
  • If an error occurred, the severity is 10.
• For API events:
  • If the event is successful, the severity is 3.
  • If an error occurred, the severity is 8.