Skip to main content

RAD Security

RAD Security (formerly KSOC (Kubernetes Security Operations Center)) is a cloud security tool specifically designed for Kubernetes environments. You can bring cluster, container image, plugin, resource, and security data from RAD Security into Brinqa to provide a unified view of your Kubernetes-related attack surface, thus enhancing your cybersecurity posture.

This document details the information you must provide for the connector to authenticate with RAD Security and how to obtain that information from RAD Security. See create a data integration for step-by-step instructions on setting up the integration.

Required connection settings

When setting up a data integration, select RAD Security from the Connector drop-down. If you cannot find the connector in the drop-down, make sure that you have installed it first. You must provide the following information to authenticate RAD Security with Brinqa:

  • API URL: The RAD Security API Server URL. The default URL is https://api.ksoc.com/.

  • Secret key and Access key: The access keys associated with the RAD Security account, which must have permissions to log in to the API server and return data.

  • Parent account ID: The account ID associated with the RAD Security account, which must have permissions to log in to the API server and return data.

Generate RAD Security access keys

For the RAD Security connector to access the KSOC API, you must provide access keys. RAD Security does not allow retrieving the secret key for an existing user, therefore, you must generate a new one instead. To obtain these access keys, follow these steps:

  1. Login to your organization's RAD Security portal.

  2. Navigate to Settings > Access Keys.

  3. Click New Key. The Add Access Key window displays.

    Provide the following information:

    • Access Key Name: Provide a name for the key.

    • Key Type: You have two options: Generic or Cloud.

      • Generic Key: Use this key type if your Kubernetes clusters are self-hosted, such as on-premises or in a data center where cloud-specific features are not a necessity.

      • Cloud Key: Use this key type if you're using cloud services for hosting your Kubernetes clusters, such as AWS, Azure, Google Cloud, and etc.

  4. Click Create Key.

The Key ID and Secret Key display. You cannot view the secret key again. Copy the key and save it in a secure location. The Key ID is the Access key used in the integration configuration.

note

If you do not have the permissions to create access keys, contact your RAD Security administrator. For additional information, see RAD Security documentation.

Additional settings

The RAD Security connector contains additional options for specific configuration:

  • Page size: The maximum number of records to get per API request. The default setting is 100. It is not recommended to go over 100.

  • Parallel requests: The maximum number of parallel API requests. The default setting is 4.

Types of data to retrieve

The RAD Security connector can retrieve the following types of data from the KSOC API:

Table 1: Data retrieved from RAD Security

Connector ObjectRequiredMaps to Data Model
ClusterNoCloud Resource
FindingNoNot mapped
Finding DefinitionNoNot mapped
ImageNoContainer Image
PluginNoNot mapped
ResourceNoCloud Resource
Threat VectorNoNot mapped
Threat Vector DefinitionNoNot mapped
info

For detailed steps on how to view the data retrieved from RAD Security in the Brinqa Platform, see How to view your data.

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes.

Cluster

Table 2: Cluster attribute mappings

Source Field NameMaps to Attribute
aws.accountIdcloudAccountId
aws.clusterArnLocal variable
aws.clusterCreatedAtLocal variable
aws.clusterNameLocal variable
aws.clusterRegionLocal variable
categoriescategories
clusterResource.accountIdLocal variable
clusterResource.caCertDigestLocal variable
clusterResource.cloudProviderTypecloudProvider
clusterResource.createdAtsourceCreatedDate
clusterResource.deletedAtLocal variable
clusterResource.endpointHashLocal variable
clusterResource.idAsStringuid
clusterResource.kubernetesVersionLocal variable
clusterResource.kubewatcherVersionLocal variable
clusterResource.locationlocation
clusterResource.namename
clusterResource.nodeCountLocal variable
clusterResource.regionregion
clusterResource.statusstatus
clusterResource.updatedAtsourceLastModified
clusterResource.workloadCountLocal variable
tags.keytags
tags.sourceLocal variable
tags.valueLocal variable
info

Local variable indicates that the field is processed within a specific context, such as a particular workflow or calculation. Unlike other attributes, local variables aren't mapped to the unified data models. They only exist on the source data model.

Image

Table 3: Image attribute mappings

Source Field NameMaps to Attribute
categoriescategories
imageResource.accountIdLocal variable
imageResource.clusterIdstargets
imageResource.clusterToPodCountLocal variable
imageResource.criticalCountLocal variable
imageResource.digestuid, digest
imageResource.highCountLocal variable
imageResource.lowCountLocal variable
imageResource.mediumCountLocal variable
imageResource.namename
imageResource.negligibleCountLocal variable
imageResource.repoLocal variable
imageResource.scanIdLocal variable
imageResource.scannedAtlastScanned
imageResource.tagstags
imageResource.totalCountLocal variable
imageResource.unspecifiedCountLocal variable
info

Local variable indicates that the field is processed within a specific context, such as a particular workflow or calculation. Unlike other attributes, local variables aren't mapped to the unified data models. They only exist on the source data model.

Resource

Table 4: Resource attribute mappings

Source Field NameMaps to Attribute
categoriescategories
resourceObject.accountIdLocal variable
resourceObject.apiVersionLocal variable
resourceObject.clusterIdtargets
resourceObject.deletedAtLocal variable
resourceObject.deletionSourceLocal variable
resourceObject.iduid
resourceObject.ingestedAtLocal variable
resourceObject.kind kindkind
resourceObject.namename
resourceObject.namespaceLocal variable
resourceObject.ownerUidowner
resourceObject.rawLocal variable
resourceObject.resourceCreatedAtsource created time
resourceObject.resourceVersioncurrent version
resourceObject.uidLocal variable
resourceObject.versionOverwrittenAtLocal variable
resourceObject.watchedAtLocal variable
info

Local variable indicates that the field is processed within a specific context, such as a particular workflow or calculation. Unlike other attributes, local variables aren't mapped to the unified data models. They only exist on the source data model.

Operation options

The RAD Security connector supports the following operation options. See connector operation options for information about how to apply them.

Table 5: RAD Security connector operation options

Connector ObjectOptionAll Possible ValuesDescriptionExample
ResourcenamespaceAny RAD Security resource namespaceA comma-separated list of resource namespaces. Retrieve resources associated with the specified namespaces.Key: namespace Value: artifactory,jenkins. This key and value combination only retrieves resources associated with the specified namespaces.
resource_typesAny RAD Security resource typeA comma-separated list of resource types. Retrieve resources of the specified types.Key: resource_types Value: dvwa-app,revshell-pod. This key and value combination only retrieves resources associated with the specified types.
note

The option keys and values are case-sensitive as they are shown in this documentation.

APIs

The RAD Security connector uses the KSOC API. Specifically, it uses the following endpoints:

Table 6: RAD Security API Endpoints

Connector ObjectAPI Endpoints
ClusterGET /accounts/{accountId}/clusters
GET /accounts/{accountId}/clusters/{clusterId}
FindingGET /accounts/{accountId}/misconfig
Finding DefinitionGET /accounts/{accountId}/clusters/{clusterId}/guardpolicies
ImageGET accounts/{accountId}/images
PluginGET /accounts/{accountId}/clusters/{clusterId}
ResourceGET /clusters/{clusterId}/resources
GET /clusters/{clusterId}/resources/{resourceId}/owners
Threat VectorGET /accounts/{accountId}/clusters
GET /accounts/{accountId}/threat_vector_instances/v2
Threat Vector DefinitionGET /accounts/{accountId}/clusters
GET /accounts/{accountId}/threat_vector_instances/v2

Changelog

The RAD Security connector has undergone the following changes:

3.0.4

  • Updated the RAW attribute in the Resource object to retrieve the entire payload and encode it with the Base64 format.

  • Added new operation options, namespace and resource_types, to filter the Resource object.

3.0.3

  • Fixed an issue where the Image object sync was failing.

3.0.1