Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 11 additions & 7 deletions host/default.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,12 @@ spec:
- run:
collectorName: "top"
command: "top"
args: ["-b", "-n", "1"]
args: ['-b', '-n', '1', '-c', '-w', '512']
- run:
# -c and -w are not supported on all systems such as busybox
collectorName: top-few-args
command: top
args: ['-b', '-n', '1']
- run:
collectorName: "uptime"
command: "uptime"
Expand Down Expand Up @@ -460,7 +465,7 @@ spec:
- run:
collectorName: "ps-detect-antivirus-and-security-tools"
command: "sh"
args: [-c, "ps -ef | grep -E 'clamav|sophos|esets_daemon|fsav|symantec|mfend|ds_agent|kav|bdagent|s1agent|falcon|illumio|xagt|wdavdaemon|mdatp' | grep -v grep"]
args: [-c, "ps -ef | grep -iE 'avast|avg|bdagent|BESClient|bitdefender|carbonblack|cbdaemon|clamav|crowdstrike|cylance|ds_agent|esets_daemon|falcon|fsav|illumio|kaspersky|kav|macmnsvc|malwarebytes|masvc|mcafee|mdatp|mfeespd|mfend|mfetpd|nessus|qualys|rapid7|s1agent|sentinel|sophos|symantec|tanium|tenable|trend|wdavdaemon|xagt' | grep -v grep"]
- systemPackages:
collectorName: security-tools-packages
rhel:
Expand Down Expand Up @@ -886,15 +891,14 @@ spec:
- textAnalyze:
checkName: "Detect Threat Management and Network Security Tools"
fileName: host-collectors/run-host/ps-detect-antivirus-and-security-tools.txt
regex: '\b(clamav|sophos|esets_daemon|fsav|symantec|mfend|ds_agent|kav|bdagent|s1agent|falcon|illumio|xagt|wdavdaemon|mdatp)\b'
regexGroups: '(?ms)(?P<Detected>.*)'
ignoreIfNoFiles: true
outcomes:
- pass:
when: "Detected == ''"
message: "No antivirus or network security tools detected."
- fail:
when: "true"
message: "Antivirus or Network Security tools detected. These tools can interfere with kubernetes operation."
- pass:
when: "false"
message: "No Antivirus or Network Security tools detected."
- systemPackages:
collectorName: security-tools-packages
outcomes:
Expand Down