Configurar um alvo IBM Cloud Object Storage

IBM Cloud Object Storage é usado como alvo para os eventos do Activity Tracker Event Routing. Esses eventos serão coletados posteriormente pelo site Workload Protection para analisar possíveis atividades suspeitas.

Siga as instruções para Configurar um alvo Cloud Object Storage.

Depois de configurar o alvo, salve os seguintes valores que serão usados em etapas posteriores:

• O nome da instância Object Storage. Ele será referenciado como <your_cos_instance_name>.

• O nome do bucket Object Storage. Ele será referenciado como <cos_bucket_name>.

• A região do balde Object Storage. Ele será referenciado como <cos_bucket_region>.

  Quando você configurar a rota Activity Tracker Event Routing, certifique-se de que a regra de rota inclua o local global além da região de implementação. Os eventos de IAM, como alterações de configurações de conta, modificações de MFA, exclusões de políticas e alterações de restrições baseadas em contexto, são gerados como eventos globais e não são roteados, a menos que o site global seja explicitamente incluído.

  Sem o local global, os eventos de mutação do IAM não chegarão ao bucket Object Storage e não serão analisados por Workload Protection.

Crie um ID de serviço e chave de API

Crie o ID do serviço e uma chave de API para que o aplicativo Code Engine envie eventos para sua instância Workload Protection.

ibmcloud iam service-id-create send-cdr-events-id --description "Service ID for CDR event forwarding"

ibmcloud iam service-api-key-create send-cdr-events-key send-cdr-events-id --description "API Key for CDR app"

Salve a chave de API gerada e o identificador de ID do serviço (o valor ServiceId-xxx retornado pelo primeiro comando). Ambos serão usados nas etapas a seguir.

Conceda ao Service ID Reader acesso ao site IBM Cloud® Container Registry para que o Code Engine possa extrair a imagem do aplicativo CDR:

ibmcloud iam service-policy-create send-cdr-events-id --roles Reader --service-name container-registry

Crie o perfil confiável para ler os eventos do Object Storage

Crie o perfil confiável (você pode modificar o nome). Salve o endereço ID para ser usado posteriormente. Posteriormente, ele será referenciado como <trusted_profile_id>:

ibmcloud iam trusted-profile-create ibmcdr-wp-cos --description "Trusted profile for Workload Protection interaction with Cloud Object Storage bucket"

Atribua a relação de confiança para a instância Workload Protection. Substitua <workload-protection-instance-crn> por seu CRN Workload Protection:

ibmcloud iam trusted-profile-identity-create ibmcdr-wp-cos --id <workload-protection-instance-crn> --id-type CRN

Atribua a relação de confiança para o ID de serviço criado na etapa 2. Substitua <service_id> pelo identificador de ID de serviço (ServiceId-xxx):

ibmcloud iam trusted-profile-identity-create ibmcdr-wp-cos --id <service_id> --id-type serviceid

Crie a política para o perfil confiável do leitor IBM Cloud Object Storage. Substitua <cos_bucket_name> pelo nome do bucket criado na etapa 1:

ibmcloud iam trusted-profile-policy-create ibmcdr-wp-cos -r "Content Reader,Reader" --service-name cloud-object-storage --resource-type bucket --resource <cos_bucket_name>

Crie a política para o perfil confiável para acessar o CDR Service ID. Substitua <service_id> pela ID de serviço criada na etapa 2:

ibmcloud iam trusted-profile-policy-create ibmcdr-wp-cos -r Viewer --service-name iam-identity --resource-type serviceid --resource <service_id>

Criar o projeto Code Engine e os segredos

Crie um segredo em Code Engine para injetar a chave da API com segurança

Crie o seu projeto do Code Engine:

ibmcloud ce project create --name <code_engine_project>

Crie o segredo do aplicativo (ele será usado como variável). Substitua <your_api_key> pela chave gerada na etapa anterior:

ibmcloud ce secret create --name cdr-secrets --from-literal API_KEY=<your_api_key>

Crie o segredo para extrair imagens do site Container Registry. Substitua <your_api_key> pela chave gerada na etapa anterior:

ibmcloud ce secret create --name icr-secret --format registry --server icr.io --username iamapikey --password <your_api_key> --email noreply@cdr-app.ibm.cloud

Criar o aplicativo Code Engine

Certifique-se de substituir as seguintes variáveis no comando:

• <target_account_id> com a ID da conta IBM Cloud.
• <trusted_profile_id> com o perfil confiável criado na etapa 3.
• <environment_url> com o endpoint Workload Protection de sua região. Por exemplo, se sua instância estiver em Dallas, substitua <environment_url> por us-south.security-compliance-secure.cloud.ibm.com.
• <service_id> com a ID de serviço criada na etapa 2.

ibmcloud ce application create \
  --name "sccwp-cdr-app" \
  --image icr.io/ext/sysdig/cdr-notification-app:latest \
  --min-scale 1 \
  --max-scale 10 \
  --cpu 0.125 \
  --memory 500M \
  --request-timeout 60 \
  --service-account default \
  --env TARGET_ACCOUNT_ID=<target_account_id> \
  --env TRUSTED_PROFILE_ID=<trusted_profile_id> \
  --env FORWARD_URL="https://<environment_url>/api/cloudingestion/webhooks/ibm/v1/<service_id>" \
  --env API_KEY=cdr-secrets:API_KEY \
  --registry-secret icr-secret

A tabela a seguir descreve os principais parâmetros usados no comando:

Conecte o IBM Cloud Object Storage Bucket a Code Engine

Configure uma assinatura de evento para conectar os eventos do bucket Object Storage a Code Engine.

Conceda permissões para garantir que o site Code Engine possa gerenciar as notificações na instância Object Storage. Substitua <code_engine_project> pelo projeto Code Engine criado na etapa 4 e <your_cos_instance_name> pelo nome da instância IBM Cloud Object Storage criada na etapa 1:

ibmcloud iam authorization-policy-create codeengine cloud-object-storage "Notifications Manager" --source-service-instance-name <code_engine_project> --target-service-instance-name <your_cos_instance_name>

Crie uma assinatura para garantir que, sempre que o Activity Tracker Event Routing arquivar um arquivo de registro no bucket, o aplicativo seja acionado. Substitua <cos_bucket_name> pelo nome do bucket da etapa 1:

ibmcloud ce subscription cos create --name cdr-cos-sub \
   --bucket <cos_bucket_name> \
   --destination sccwp-cdr-app \
   --event-type write

Habilite o CDR para sua conta em Workload Protection

Certifique-se de substituir as seguintes variáveis no comando:

• <wp_instance_name> com seu nome de instância ou GUID Workload Protection. Recomenda-se usar o GUID para evitar ambiguidade se várias instâncias compartilharem o mesmo nome.
• <cos_bucket_region> com a região do compartimento Object Storage criado na etapa 1.
• <cos_bucket_name> com o nome do bucket Object Storage criado na etapa 1.
• <trusted_profile_id> com o ID do perfil confiável salvo na etapa 3.
• <environment_url> com o endpoint Workload Protection de sua região.
• <service_id> com o identificador de ID de serviço (o valor ServiceId-xxx ) da etapa 2.
• <target_account_id> com a ID da conta IBM Cloud.

ibmcloud resource service-instance-update "<wp_instance_name>" -p '{"enable_cdr": true, "target_cdr_accounts": [{"cdr_bucket_region": "<cos_bucket_region>","cdr_bucket_name": "<cos_bucket_name>","cdr_trusted_profile_id": "<trusted_profile_id>","cdr_service_id": "<service_id>", "cdr_ingestion_url": "https://<environment_url>/api/cloudingestion/webhooks/ibm/v1/<service_id>", "account_id":"<target_account_id>"}]}' -g Default

Se você tiver algum erro, consulte Por que minha conta IBM Cloud não está ingerindo eventos de auditoria?

Criar as regras de detecção de ameaças

Copie o conteúdo a seguir e cole-o em Custom Rules em Policies > Detection & Response Policies > Rules Editor e clique em Save.

- required_engine_version: 51
- rule: IBM Cloud IAM Policy Deleted
  desc: >
    Detects successful deletion of an IAM access policy. Removing policies
    weakens authorization controls and may indicate an attacker impairing
    defenses. Filters to outcome=success since failed deletions do not
    change security posture.
  condition: >
    jevt.value[/action] = "iam-am.policy.delete"
    and jevt.value[/outcome] = "success"
  exceptions:
  - name: user_action
    fields: ["ibm.initiator.id", "ibm.action"]
  - name: user_account
    fields: ["ibm.initiator.id", "ibm.accountId"]
  - name: user_target
    fields: ["ibm.initiator.id", "ibm.target.id"]
  - name: user_action_contains
    fields: ["ibm.initiator.id", "ibm.action"]
    comps: [contains, "="]
  output: >
    IAM policy %ibm.target.name was deleted by %ibm.initiator.name
    (user=%ibm.initiator.name,
    user_id=%ibm.initiator.id,
    credential=%ibm.initiator.credential.type,
    source_ip=%ibm.initiator.host.address,
    target=%ibm.target.name,
    target_id=%ibm.target.id,
    action=%ibm.action,
    outcome=%ibm.outcome,
    message=%ibm.message,
    account=%ibm.accountId,
    region=%ibm.region)
  priority: WARNING
  source: ibm_activitytracker
  tags: [ibm, iam, defense-evasion, T1562.001]
- rule: IBM Cloud IAM Service ID Deleted
  desc: >
    Detects successful deletion of an IAM service ID. Removing a service ID
    destroys a non-human identity along with its associated policies and API
    keys, denying access to any workloads or users that depended on it.
    Filters to outcome=success since failed deletions do not change security
    posture.
  condition: >
    jevt.value[/action] = "iam-identity.account-serviceid.delete"
    and jevt.value[/outcome] = "success"
  exceptions:
  - name: user_action
    fields: ["ibm.initiator.id", "ibm.action"]
  - name: user_account
    fields: ["ibm.initiator.id", "ibm.accountId"]
  - name: user_target
    fields: ["ibm.initiator.id", "ibm.target.id"]
  - name: user_action_contains
    fields: ["ibm.initiator.id", "ibm.action"]
    comps: [contains, "="]
  output: >
    Service ID %ibm.target.name was deleted by %ibm.initiator.name
    (user=%ibm.initiator.name,
    user_id=%ibm.initiator.id,
    credential=%ibm.initiator.credential.type,
    source_ip=%ibm.initiator.host.address,
    target=%ibm.target.name,
    target_id=%ibm.target.id,
    action=%ibm.action,
    outcome=%ibm.outcome,
    message=%ibm.message,
    account=%ibm.accountId,
    region=%ibm.region)
  priority: NOTICE
  source: ibm_activitytracker
  tags: [ibm, iam, impact, T1531]
- rule: IBM Cloud IAM Service ID API Key Created
  desc: >
    Detects creation of an API key on a service ID. Service ID API keys
    are a persistence technique -- they are stealthier than user API keys
    since service IDs typically receive less scrutiny.
  condition: >
    jevt.value[/action] = "iam-identity.serviceid-apikey.create"
  exceptions:
  - name: user_action
    fields: ["ibm.initiator.id", "ibm.action"]
  - name: user_account
    fields: ["ibm.initiator.id", "ibm.accountId"]
  - name: user_target
    fields: ["ibm.initiator.id", "ibm.target.id"]
  - name: user_action_contains
    fields: ["ibm.initiator.id", "ibm.action"]
    comps: [contains, "="]
  output: >
    An API key %ibm.target.name was created by %ibm.initiator.name
    (user=%ibm.initiator.name,
    user_id=%ibm.initiator.id,
    credential=%ibm.initiator.credential.type,
    source_ip=%ibm.initiator.host.address,
    target=%ibm.target.name,
    target_id=%ibm.target.id,
    action=%ibm.action,
    outcome=%ibm.outcome,
    message=%ibm.message,
    account=%ibm.accountId,
    region=%ibm.region)
  priority: WARNING
  source: ibm_activitytracker
  tags: [ibm, iam, persistence, T1098.001]
- rule: IBM Cloud IAM User API Key Created
  desc: >
    Detects creation of a user API key. User API keys grant persistent
    access that survives session expiration, making them a common
    persistence mechanism for maintaining access to IBM Cloud.
  condition: >
    jevt.value[/action] = "iam-identity.user-apikey.create"
  exceptions:
  - name: user_action
    fields: ["ibm.initiator.id", "ibm.action"]
  - name: user_account
    fields: ["ibm.initiator.id", "ibm.accountId"]
  - name: user_target
    fields: ["ibm.initiator.id", "ibm.target.id"]
  - name: user_action_contains
    fields: ["ibm.initiator.id", "ibm.action"]
    comps: [contains, "="]
  output: >
    A user API key %ibm.target.name was created by %ibm.initiator.name
    (user=%ibm.initiator.name,
    user_id=%ibm.initiator.id,
    credential=%ibm.initiator.credential.type,
    source_ip=%ibm.initiator.host.address,
    target=%ibm.target.name,
    target_id=%ibm.target.id,
    action=%ibm.action,
    outcome=%ibm.outcome,
    message=%ibm.message,
    account=%ibm.accountId,
    region=%ibm.region)
  priority: WARNING
  source: ibm_activitytracker
  tags: [ibm, iam, persistence, T1098.001]
- rule: IBM Cloud IAM Service ID Created
  desc: >
    Detects creation of a new IAM service ID. Service IDs are non-human
    identities that can hold their own policies and API keys. Creating
    one establishes a new identity that can be used for persistent access.
  condition: >
    jevt.value[/action] = "iam-identity.account-serviceid.create"
  exceptions:
  - name: user_action
    fields: ["ibm.initiator.id", "ibm.action"]
  - name: user_account
    fields: ["ibm.initiator.id", "ibm.accountId"]
  - name: user_target
    fields: ["ibm.initiator.id", "ibm.target.id"]
  - name: user_action_contains
    fields: ["ibm.initiator.id", "ibm.action"]
    comps: [contains, "="]
  output: >
    Service ID %ibm.target.name was created by %ibm.initiator.name
    (user=%ibm.initiator.name,
    user_id=%ibm.initiator.id,
    credential=%ibm.initiator.credential.type,
    source_ip=%ibm.initiator.host.address,
    target=%ibm.target.name,
    target_id=%ibm.target.id,
    action=%ibm.action,
    outcome=%ibm.outcome,
    message=%ibm.message,
    account=%ibm.accountId,
    region=%ibm.region)
  priority: NOTICE
  source: ibm_activitytracker
  tags: [ibm, iam, persistence, T1136.003]
- rule: IBM Cloud IAM Account Settings Updated
  desc: >
    Detects updates to IAM account-wide security settings. These settings
    control MFA policy, session lifetimes, IP restrictions, and allowed
    authentication methods for the entire account. Changes weaken the
    security posture for every identity in the account.
  condition: >
    jevt.value[/action] = "iam-identity.account-settings.update"
  exceptions:
  - name: user_action
    fields: ["ibm.initiator.id", "ibm.action"]
  - name: user_account
    fields: ["ibm.initiator.id", "ibm.accountId"]
  - name: user_target
    fields: ["ibm.initiator.id", "ibm.target.id"]
  - name: user_action_contains
    fields: ["ibm.initiator.id", "ibm.action"]
    comps: [contains, "="]
  output: >
    IAM account settings were updated by %ibm.initiator.name
    (user=%ibm.initiator.name,
    user_id=%ibm.initiator.id,
    credential=%ibm.initiator.credential.type,
    source_ip=%ibm.initiator.host.address,
    target=%ibm.target.name,
    target_id=%ibm.target.id,
    action=%ibm.action,
    outcome=%ibm.outcome,
    message=%ibm.message,
    account=%ibm.accountId,
    region=%ibm.region)
  priority: WARNING
  source: ibm_activitytracker
  tags: [ibm, iam, defense-evasion, T1562]
- rule: IBM Cloud IAM Access Group Settings Updated
  desc: >
    Detects updates to IAM access group settings. These settings control
    who can create access groups and whether groups can be made public.
    Loosening these restrictions enables broader group membership or
    unauthorized group creation, expanding access beyond intended scope.
  condition: >
    jevt.value[/action] = "iam-groups.account-settings.update"
  exceptions:
  - name: user_action
    fields: ["ibm.initiator.id", "ibm.action"]
  - name: user_account
    fields: ["ibm.initiator.id", "ibm.accountId"]
  - name: user_target
    fields: ["ibm.initiator.id", "ibm.target.id"]
  - name: user_action_contains
    fields: ["ibm.initiator.id", "ibm.action"]
    comps: [contains, "="]
  output: >
    IAM access group settings were updated by %ibm.initiator.name
    (user=%ibm.initiator.name,
    user_id=%ibm.initiator.id,
    credential=%ibm.initiator.credential.type,
    source_ip=%ibm.initiator.host.address,
    target=%ibm.target.name,
    target_id=%ibm.target.id,
    action=%ibm.action,
    outcome=%ibm.outcome,
    message=%ibm.message,
    account=%ibm.accountId,
    region=%ibm.region)
  priority: NOTICE
  source: ibm_activitytracker
  tags: [ibm, iam, persistence, T1098]
- rule: IBM Cloud IAM User API Key Deleted
  desc: >
    Detects deletion of a user API key. Deleting API keys used during
    an attack removes evidence of the credential that was used. Pairs
    with the User API Key Created rule to track the full lifecycle of
    user credentials.
  condition: >
    jevt.value[/action] = "iam-identity.user-apikey.delete"
  exceptions:
  - name: user_action
    fields: ["ibm.initiator.id", "ibm.action"]
  - name: user_account
    fields: ["ibm.initiator.id", "ibm.accountId"]
  - name: user_target
    fields: ["ibm.initiator.id", "ibm.target.id"]
  - name: user_action_contains
    fields: ["ibm.initiator.id", "ibm.action"]
    comps: [contains, "="]
  output: >
    A user API key was deleted by %ibm.initiator.name
    (user=%ibm.initiator.name,
    user_id=%ibm.initiator.id,
    credential=%ibm.initiator.credential.type,
    source_ip=%ibm.initiator.host.address,
    target=%ibm.target.name,
    target_id=%ibm.target.id,
    action=%ibm.action,
    outcome=%ibm.outcome,
    message=%ibm.message,
    account=%ibm.accountId,
    region=%ibm.region)
  priority: NOTICE
  source: ibm_activitytracker
  tags: [ibm, iam, defense-evasion, T1070]
- rule: IBM Cloud User Removed
  desc: >
    Detects removal of a user from the IBM Cloud account. Removing a
    user locks out defenders and legitimate admins. This is irreversible
    without re-inviting the user. Denies access to legitimate responders
    during an incident.
  condition: >
    jevt.value[/action] = "user-management.user.delete"
    and jevt.value[/outcome] = "success"
  exceptions:
  - name: user_action
    fields: ["ibm.initiator.id", "ibm.action"]
  - name: user_account
    fields: ["ibm.initiator.id", "ibm.accountId"]
  - name: user_target
    fields: ["ibm.initiator.id", "ibm.target.id"]
  - name: user_action_contains
    fields: ["ibm.initiator.id", "ibm.action"]
    comps: [contains, "="]
  output: >
    A user was removed from the account by %ibm.initiator.name
    (user=%ibm.initiator.name,
    user_id=%ibm.initiator.id,
    credential=%ibm.initiator.credential.type,
    source_ip=%ibm.initiator.host.address,
    target=%ibm.target.name,
    target_id=%ibm.target.id,
    action=%ibm.action,
    outcome=%ibm.outcome,
    message=%ibm.message,
    account=%ibm.accountId,
    region=%ibm.region)
  priority: WARNING
  source: ibm_activitytracker
  tags: [ibm, user-management, defense-evasion, T1531]
- rule: IBM Cloud User Settings Updated
  desc: >
    Detects updates to individual user settings. These settings control
    a user's IP restrictions and allowed authentication methods. Changing
    them weakens security controls at the individual user level, enabling
    access from previously restricted locations or methods.
  condition: >
    jevt.value[/action] = "user-management.user.update"
    and jevt.value[/outcome] = "success"
  exceptions:
  - name: user_action
    fields: ["ibm.initiator.id", "ibm.action"]
  - name: user_account
    fields: ["ibm.initiator.id", "ibm.accountId"]
  - name: user_target
    fields: ["ibm.initiator.id", "ibm.target.id"]
  - name: user_action_contains
    fields: ["ibm.initiator.id", "ibm.action"]
    comps: [contains, "="]
  output: >
    User settings were updated by %ibm.initiator.name
    (user=%ibm.initiator.name,
    user_id=%ibm.initiator.id,
    credential=%ibm.initiator.credential.type,
    source_ip=%ibm.initiator.host.address,
    target=%ibm.target.name,
    target_id=%ibm.target.id,
    action=%ibm.action,
    outcome=%ibm.outcome,
    message=%ibm.message,
    account=%ibm.accountId,
    region=%ibm.region)
  priority: NOTICE
  source: ibm_activitytracker
  tags: [ibm, user-management, defense-evasion, T1562]

Essas regras são exemplos de detecção de atividades suspeitas e de higiene de segurança insatisfatória, visando Cloud Identity and Access Management.

Encontre todas as referências e detalhes das regras na Biblioteca de referência para IBM Cloud CDR Threat Detection Rules

Criar e ativar a política de detecção de ameaças

Vá para Políticas > Políticas de detecção e resposta > Políticas de tempo de execução e clique em Add Policy. Selecione a política IBM Activity Tracker.

Escolha as regras que deseja usar clicando em Managed & Import em Policy Rules.

Defina as ações a serem tomadas se as regras da política forem violadas, como Notificar um e-mail ou canal do Slack. O canal de notificação precisa ser criado antes dessa etapa.

Habilite e salve a política.