Network Connection outside Local Subnet

Description

Detect network traffic (inbound or outbound) from a container to a destination outside the local subnet. To operationalize this rule, profile your environment and update the template macro namespace_scope_network_only_subnet. Customizing network-related rules usually demands substantial engineering effort to ensure their functionality.

Query · falco

inbound_outbound and container and k8s.ns.name in (namespace_scope_network_only_subnet) and not network_local_subnet

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro inbound_outbound
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro network_local_subnet
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Network connection outside local subnet | fd_rip_name=%fd.rip.name fd_lip_name=%fd.lip.name fd_cip_name=%fd.cip.name fd_sip_name=%fd.sip.name connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Network Connection outside Local Subnet · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Network Connection outside Local Subnet
desc: 'Detect network traffic (inbound or outbound) from a container to a destination
  outside the local subnet. To operationalize this rule, profile your environment
  and update the template macro namespace_scope_network_only_subnet. Customizing network-related
  rules usually demands substantial engineering effort to ensure their functionality.

  '
condition: 'inbound_outbound and container and k8s.ns.name in (namespace_scope_network_only_subnet)
  and not network_local_subnet

  '
output: Network connection outside local subnet | fd_rip_name=%fd.rip.name fd_lip_name=%fd.lip.name
  fd_cip_name=%fd.cip.name fd_sip_name=%fd.sip.name connection=%fd.name lport=%fd.lport
  rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: WARNING
tags:
- maturity_incubating
- container
- network
- mitre_discovery
- T1046
- PCI_DSS_6.4.2

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.