IBM Cloud CDR threat detection rules reference library

Create and customize threat detection rules to detect suspicious activity in your IBM Cloud environments. This reference covers all fields available for writing Falco rules against IBM Cloud audit events ingested via CDR.

Rules targeting IBM Cloud audit events must use source: ibm_activitytracker. Fields can be accessed directly by their plugin name (e.g. ibm.action) or via the raw JSON path using jevt.value[/fieldPath] (for example jevt.value[/action]).

Fields

In Threat Detection rules, a field represents one specific attribute the event captured from a raw event. You can use fields to define the detection condition and the output.

Field Class: ibm (event)

Top-level fields present in every IBM Cloud audit event.

Event Sources: ibm_activitytracker

Name Type JSON path Description
ibm.action string /action The action that triggered the event. For example, iam-am.policy.delete or iam-identity.user-apikey.create.
ibm.correlationId string /correlationId Unique GUID used to correlate related events across multiple services in the same account.
ibm.dataEvent boolean /dataEvent Indicates whether the event is a data event (true) or a management event (false).
ibm.eventTime string /eventTime Timestamp when the event was created, in ISO 8601 format.
ibm.id string /id Optional field that can be used to correlate activity tracking events within a service.
ibm.logSourceCRN string /logSourceCRN Cloud Resource Name (CRN) of the service instance that generated the event.
ibm.message string /message Human-readable description of the event.
ibm.observer.name string /observer/name Always set to ActivityTracker. Identifies the observer service that recorded the event.
ibm.outcome string /outcome Result of the action. Typical values: success, failure, pending.
ibm.requestData JSON /requestData Additional information about the request, when available.
ibm.responseData JSON /responseData Additional information about the response, when available.
ibm.saveServiceCopy boolean /saveServiceCopy When true, the service that generated the event saves a copy for IBM Cloud auditing.
ibm.severity string /severity Level of threat the action may have on IBM Cloud. Typical values: normal, warning, critical.

Field Class: ibm.initiator

Fields that describe the identity and origin of the entity that requested the action.

Event Sources: ibm_activitytracker

Name Type JSON path Description
ibm.initiator.id string /initiator/id ID of the initiator that requested the action. For users this is the IBMid; for service IDs this is the ServiceId-xxx value.
ibm.initiator.name string /initiator/name Username or name of the initiator. When the initiator is an IBM service, this field is set to IBM or the name of the service.
ibm.initiator.authnId string /initiator/authnId ID of the user that logged in to IBM Cloud.
ibm.initiator.authnName string /initiator/authnName Username of the user that logged in to IBM Cloud.
ibm.initiator.typeURI string /initiator/typeURI Type of the event source. For example, service/security/account/user or service/security/account/serviceid.
ibm.initiator.credential.type string /initiator/credential/type Type of credential used by the initiator. Typical values: apikey, token, serviceid.
ibm.initiator.host.address string /initiator/host/address IP address or URL from which the request originated, such as the IBM Cloud console or CLI.
ibm.initiator.host.addressType string /initiator/host/addressType Type of IP address. For example, IPv4 or IPv6.
ibm.initiator.host.agent string /initiator/host/agent User-agent string identifying where the request originated, for example a CLI version or browser.

Field Class: ibm.target

Fields that describe the IBM Cloud resource on which the action was executed.

Event Sources: ibm_activitytracker

Name Type JSON path Description
ibm.target.id string /target/id CRN or identifier of the IBM Cloud resource on which the action was executed.
ibm.target.name string /target/name Human-readable name of the IBM Cloud resource on which the action was executed.
ibm.target.alias string /target/alias Alias of the cloud resource used in the request, when applicable.
ibm.target.typeURI string /target/typeURI Type of the target resource. For example, iam-am/policy or iam-identity/account/serviceid.
ibm.target.resourceGroupId string /target/resourceGroupId CRN of the resource group associated with the target resource.
ibm.target.host.address string /target/host/address IP address or URL of the target service.

Field Class: ibm.reason

Fields that provide additional detail about the outcome of an action, particularly for failed requests.

Event Sources: ibm_activitytracker

Name Type JSON path Description
ibm.reason.reasonCode numeric /reason/reasonCode HTTP response code of the requested action. For example, 200 for success or 403 for unauthorized.
ibm.reason.reasonType string /reason/reasonType Additional information about the result. For example, OK or Forbidden.
ibm.reason.reasonForFailure string /reason/reasonForFailure Additional detail explaining why the action failed, when available.

Rule writing examples

The following examples show how to reference these fields in Falco rules for CDR.

Filtering by action and outcome:

condition: >
  jevt.value[/action] = "iam-am.policy.delete"
  and jevt.value[/outcome] = "success"

Filtering by initiator credential type:

condition: >
  jevt.value[/action] startswith "iam-identity"
  and jevt.value[/initiator/credential/type] = "apikey"

Filtering by source IP address:

condition: >
  jevt.value[/action] = "iam-identity.user-apikey.create"
  and not jevt.value[/initiator/host/address] in (trusted_ips)

For more information about creating rules and policies, see Creating IBM Cloud Threat Detection policy.