SecOps Overview
Security operations — vulnerability detection, scanning, threat detection, and compliance auditing.
SecOps
The SecOps module provides multi-layer security operations — covering vulnerability scanning, runtime threat detection, network security monitoring, and compliance auditing across cloud resources, containers, hosts, and code repositories.
Canonical SecOps tool usage by provider and resource type is tracked in the Provider and Resource Reference.
Provider Support
Supported
AWS
GitHub
Docker Hub
Ubuntu
Not Supported
Azure
GCP- Docker
Scanning Layers
Use-Cases
- CIS benchmark checks on cloud accounts.
- IAM misconfiguration detection.
- Vulnerability scanning of VM and container images.
- Detecting suspicious activity via CloudTrail and Azure Activity Logs.
- Security posture dashboard.
Tool Architecture
Tool Reference
| Tool | Category | Targets | Scanners | Storage |
|---|---|---|---|---|
| Wazuh | SIEM / XDR | Hosts, servers, endpoints, cloud accounts (AWS/Azure/GCP), containers | File integrity, malware, CVEs, misconfigurations, compliance violations, anomalies | Elasticsearch |
| Falco | Runtime Security | Containers, Kubernetes pods, Linux hosts | Abnormal syscalls, privilege escalation, crypto-miners, unexpected processes, unauthorised network access | Elasticsearch (via Falco Sidekick) |
| Zeek | Network Security | Network traffic, packets, connections, protocols (DNS, HTTP/S, SSH, SSL/TLS) | Network anomalies, protocol violations, suspicious connections, IOC matches | Elasticsearch (via Filebeat) |
| Trivy | Vulnerability Scanner | Container images, filesystems, Git repos, IaC files, SBOMs | CVEs (OS & language packages), misconfigurations, secrets, compliance issues | JSON/HTML output |
| Cortex | Analyzer / SOAR | IP addresses, domains, URLs, file hashes | Threat intel lookups, file/IP/domain reputation, automated responses | Elasticsearch |
Wazuh
Targets: Hosts (Linux, Windows, macOS), cloud accounts (AWS/Azure/GCP), containers.
Scanners:
- File Integrity Monitoring (FIM): Detects unauthorised changes to files and directories.
- Malware detection: Signature-based scanning for known malicious files.
- Vulnerabilities (CVEs): OS and application packages with known CVEs.
- Compliance checks: CIS benchmarks, PCI-DSS, GDPR, HIPAA.
- Anomaly detection: Unusual processes, unexpected log patterns, behavioural baselines.
Falco
Targets: Containers, Kubernetes pods, Linux hosts.
Scanners:
- Abnormal system calls: Suspicious
exec, file writes. - Privilege escalation:
setuid,sudomisuse, container root escapes. - Crypto-miners / malicious processes: Hidden mining or unauthorised processes.
- Unauthorised network access: Unexpected connections, ports, or protocols.
- Suspicious container behaviour: E.g. shell spawned inside a production container.
Zeek
Targets: Network traffic, TCP/UDP flows, protocols (DNS, HTTP/S, SMTP, SSL/TLS, SSH, FTP).
Scanners:
- Network anomalies: Suspicious or abnormal traffic patterns.
- Protocol violations: Unexpected behaviour for standard protocols.
- Suspicious connections: Traffic to malicious IPs, scanning attempts.
- IOC matching: Indicators of Compromise from threat intelligence feeds.
Trivy
Targets: Container images, filesystems, Git repositories, IaC files (Kubernetes, Terraform, Helm), SBOMs.
Scanners:
- CVEs: Vulnerabilities in OS packages and language dependencies (Python, Node.js, Java, Go, Ruby).
- Misconfigurations: Kubernetes / Terraform / Helm best-practice violations.
- Secrets: Hardcoded passwords, API keys, tokens.
- Compliance: CIS hardening violations.
Cortex
Targets: Observables — IP addresses, domain names, URLs, file hashes (MD5/SHA1/SHA256).
Scanners:
- Threat intelligence: VirusTotal, AbuseIPDB, Shodan, PassiveTotal lookups.
- File reputation: Malicious hash detection.
- IP / Domain reputation: Known malicious infrastructure.
- Automated responses: Block IPs, isolate hosts, trigger scripts.