Sign inSign up

ajeetraina777/sbx-kits-panw:siem-telemetry

Manifest digest

sha256:3dfcc12574a9dd1bd2a98c3c48067f7ee69ee55e5376e29a4dbc013eac881073

Last pushed

13 days by ajeetraina777

Type

Sandbox Kit

Manifest digest

sha256:3dfcc12574a9dd1bd2a98c3c48067f7ee69ee55e5376e29a4dbc013eac881073

MIXIN

Ships sandbox observability (process, network, file, and agent-activity logs) to a SIEM HTTP event collector for dashboards, correlation, and automated response. Closes the visibility gap for what runs inside the sandbox.


Arguments
NameRequiredDefaultDescription
siemCollectorAuthIdOptional

Cortex XSIAM HTTP Collector API key ID (numeric, non-secret), sent as the x-xdr-auth-id header alongside the Authorization token. XSIAM requires both; leave empty for collectors that authenticate with the Authorization header alone.

siemCollectorHostRequired

SIEM HTTP event collector ingestion host (FQDN, no scheme).

siemCollectorPathOptional/logs/v1/event

HTTP path on the collector to POST events to.


Network Egress

${{ kit.args.siemCollectorHost }}

raw.githubusercontent.com

packages.fluentbit.io

github.com

codeload.github.com

archive.ubuntu.com

security.ubuntu.com

ports.ubuntu.com

download.docker.com

Apply this mixin to a sandbox

sbx run <agent> --kit ajeetraina777/sbx-kits-panw:siem-telemetry --set siemCollectorHost=<siemCollectorHost>

Make sure you have docker sbx installed

Run the following command to install sbx on your machine.

macOS
brew install docker/tap/sbx
Windows
winget install Docker.sbx
Learn more about docker sbx