Arsitektur Kernel Runtime Security Skala Enterprise: In-Kernel Enforcement Cilium Tetragon eBPF LSM, Falco Modern eBPF, dan Wazuh SIEM/XDR Terdistribusi

TRADISIONAL: DETEKSI ASINKRON (Falco Legacy / Auditd / Agent SIEM)
========================================================================================
[Payload Jahat] ---> [Syscall execve] ---> [Biner Berjalan & Eksfiltrasi Secret!]
                           │
                 (Event ke Ring Buffer)
                           ▼
                  [Falco / Agent Userspace]
                           │
                 (Alerting 50ms - 2000ms kemudian)
                           ▼
                  [Skrip Response Membunuh Proses (TERLAMBAT - DATA SUDAH BOCOR!)]

MODERN: PENCEGAHAN SINKRON IN-KERNEL (Cilium Tetragon eBPF LSM)
========================================================================================
[Payload Jahat] ---> [Syscall Entry Hook]
                           │
                    (LSM / Kprobe Hook)
                           ▼
             [Tetragon eBPF Program di Kernel]
                           │
             ┌─────────────┴─────────────┐
             ▼                           ▼
        [PELANGGARAN]               [OPERASI VALID]
             │                           │
  1. bpf_send_signal(SIGKILL)            ▼
  2. Override Return Code -EPERM    [Syscall Diizinkan Lanjut]
             │
             ▼
  [PROSES DIKILLED SECARA SINKRON DI KERNEL]
  [Zero Instruction Userspace Dijalankan!]

┌────────────────────────────────────────────────────────────────────────────────────────┐
│                                 KUBERNETES WORKLOAD POD                                │
│  Container Process (PID: 28412, Namespace: production, Cgroup: kubepods.slice/...)     │
└───────────────────────────────────────────┬────────────────────────────────────────────┘
                                            │ Syscall (execve, openat, connect)
                                            ▼
┌────────────────────────────────────────────────────────────────────────────────────────┐
│                                  LINUX KERNEL SPACE                                    │
│                                                                                        │
│  [ LSM Hook: security_bprm_check ] ──► Tetragon eBPF LSM Filter                        │
│                                            │                                           │
│                                            ├─► Violation? -> Call bpf_send_signal(9)   │
│                                            │                 Return -EPERM [BLOCKED!]  │
│                                            └─► Legitimate? -> Pass through             │
│                                                                                        │
│  [ Raw Tracepoint: sys_enter_* ]   ──► Falco Modern eBPF Driver                        │
│                                            │                                           │
│                                            └─► Write structured event ke BPF Ringbuf   │
└───────────────────────┬────────────────────────────────────────┬───────────────────────┘
                        │ Tetragon Perf/Ringbuf                  │ Falco Ringbuf
                        ▼                                        ▼
┌──────────────────────────────────────┐        ┌──────────────────────────────────────┐
│       TETRAGON USERSPACE AGENT       │        │         FALCO ENGINE DAEMON          │
│ - Reads in-kernel events via gRPC    │        │ - Evaluates YAML ruleset (DSL)       │
│ - Enriches with Cgroups/Pod metadata │        │ - Correlates K8s context via cache   │
│ - Streams JSON to Unix Domain Socket │        │ - Sends alerts to Falcosidekick      │
└───────────────────────┬──────────────┘        └──────────────────┬───────────────────┘
                        │                                          │
                        └────────────────────┬─────────────────────┘
                                             ▼
                        ┌─────────────────────────────────────────┐
                        │      WAZUH SIEM/XDR DISTRIBUTED CLUSTER │
                        │ - Multi-Worker Ingestion (Port 5140)    │
                        │ - Trie Rule Matching & MITRE ATT&CK     │
                        │ - Active Response Orchestration         │
                        └─────────────────────────────────────────┘

[ Tetragon Agent ] ── gRPC JSON Stream ──► [ Fluent-Bit Forwarder ] ──┐
                                                                      │ (Port 5140 TCP/TLS)
[ Falco Engine ]   ── Falcosidekick JSON ─────────────────────────────┴─► [ Wazuh Worker Nodes ]
                                                                                   │
                                                                         ┌─────────┴─────────┐
                                                                         │  wazuh-remoted    │
                                                                         │  Input Queue Buffer│
                                                                         │  (262,144 slots)  │
                                                                         └─────────┬─────────┘
                                                                                   ▼
                                                                         ┌───────────────────┐
                                                                         │  wazuh-analysisd  │
                                                                         │  - JSON Decoding  │
                                                                         │  - Trie Matching  │
                                                                         │  - MITRE Tagging  │
                                                                         └─────────┬─────────┘
                                                                                   │
                                                     ┌─────────────────────────────┴─────────────────────────────┐
                                                     ▼                                                           ▼
                                      [ OpenSearch / Wazuh Indexer ]                                [ Active Response Execd ]
                                      Index: wazuh-alerts-4.x-*                                     - Pod Network Quarantine
                                      Grafana / Security Dashboard                                  - iptables RFC 5737 Sinkhole

# /etc/tetragon/tetragon-values.yaml
# Production Hardened Configuration for Cilium Tetragon DaemonSet
tetragon:
  enabled: true
  image:
    repository: quay.io/cilium/tetragon
    tag: v1.2.0
    pullPolicy: IfNotPresent

  # Mengaktifkan In-Kernel Enforcement via LSM dan BPF Signals
  enforcement:
    enabled: true

  # eBPF Engine & Kernel Subsystem Parameters
  bpf:
    btf: "/sys/kernel/btf/vmlinux"
    mapMemoryLimit: 536870912 # Alokasi 512 MB per simpul
    ringBufferSize: 16777216  # 16 MB per CPU core buffer (Zero drops)

  # Process Filtering & Monitoring
  processCacheSize: 65536
  enableProcessNsFilter: true
  enableProcessCred: true

  # Export Telemetry via gRPC Unix Domain Socket
  export:
    mode: "stdout"
    stdout:
      enabled: false
    grpc:
      enabled: true
      address: "unix:///var/run/cilium/tetragon/tetragon.sock"
    file:
      enabled: true
      path: "/var/log/tetragon/tetragon.log"
      maxSizeMB: 100
      maxBackups: 5
      compress: true

  # Alokasi Resource & Jaminan QoS
  resources:
    limits:
      cpu: "2000m"
      memory: "1024Mi"
    requests:
      cpu: "500m"
      memory: "512Mi"

  # Security Context - Tetragon memerlukan kapabilitas kernel spesifik
  securityContext:
    privileged: false
    capabilities:
      add:
        - SYS_ADMIN
        - SYS_RESOURCE
        - SYS_PTRACE
        - BPF
        - PERFMON
        - NET_ADMIN
        - DAC_OVERRIDE

  # Host Path Mounts untuk Probing Kernel
  extraHostPathMounts:
    - name: bpf-fs
      mountPath: /sys/fs/bpf
      hostPath: /sys/fs/bpf
      mountPropagation: Bidirectional
    - name: btf-fs
      mountPath: /sys/kernel/btf
      hostPath: /sys/kernel/btf
      readOnly: true
    - name: debugfs
      mountPath: /sys/kernel/debug
      hostPath: /sys/kernel/debug

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: block-unauthorized-exec-production
  namespace: kube-system
spec:
  kprobes:
    - call: "sys_execve"
      syscall: true
      args:
        - index: 0
          type: "string" # Path biner yang dieksekusi
      selectors:
        - matchNamespaces:
            - "production"
            - "payment-gateway"
          matchArgs:
            - index: 0
              operator: "Prefix"
              values:
                - "/tmp/"
                - "/dev/shm/"
                - "/var/tmp/"
          matchActions:
            - action: Sigkill
            - action: Post
        - matchNamespaces:
            - "production"
          matchArgs:
            - index: 0
              operator: "InMap"
              values:
                - "/usr/bin/nc"
                - "/usr/bin/ncat"
                - "/usr/bin/netcat"
                - "/usr/bin/socat"
                - "/usr/bin/nmap"
                - "/usr/bin/tcpdump"
          matchActions:
            - action: Sigkill
            - action: Post

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: block-privilege-escalation
  namespace: kube-system
spec:
  kprobes:
    - call: "commit_creds"
      syscall: false
      args:
        - index: 0
          type: "cred" # struct cred*
      selectors:
        - matchArgs:
            - index: 0
              operator: "Equal"
              values:
                - "0" # Percobaan mengubah target UID menjadi 0 (Root)
          matchNamespaces:
            - "production"
          matchActions:
            - action: Sigkill
            - action: Post

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: block-sensitive-file-tampering
  namespace: kube-system
spec:
  lsm:
    - hook: "file_open"
      args:
        - index: 0
          type: "file"
      selectors:
        - matchArgs:
            - index: 0
              operator: "Prefix"
              values:
                - "/etc/shadow"
                - "/etc/passwd"
                - "/etc/pam.d/"
                - "/etc/sudoers"
                - "/etc/kubernetes/pki/"
          matchFlags:
            - "O_WRONLY"
            - "O_RDWR"
            - "O_CREAT"
            - "O_TRUNC"
          matchActions:
            - action: Override
              argError: -13 # -EACCES (Permission Denied)
            - action: Sigkill
            - action: Post

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: block-tcp-egress-c2
  namespace: kube-system
spec:
  kprobes:
    - call: "tcp_v4_connect"
      syscall: false
      args:
        - index: 0
          type: "sock"
      selectors:
        - matchNamespaces:
            - "production"
          matchArgs:
            - index: 0
              operator: "Equal"
              values:
                - "198.51.100.55" # Alamat IP C2 Sintetis RFC 5737
          matchActions:
            - action: Sigkill
            - action: Post

# /etc/falco/falco.yaml - High-Concurrency Production Tuning
engine:
  kind: modern_ebpf
  modern_ebpf:
    cpus_for_each_syscall_buffer: 1
    buffer_dim_pages: 8192 # Alokasi 32 MB per CPU core buffer

rules_files:
  - /etc/falco/falco_rules.yaml
  - /etc/falco/falco_rules.local.yaml
  - /etc/falco/rules.d/*.yaml

json_output: true
json_include_output_property: true
json_include_tags_property: true
log_stderr: false
log_syslog: false
log_level: warning
priority: notice

# Output Channels & Rate Limiting
output_timeout: 1000
buffered_outputs: true

outputs:
  rate: 2000
  max_burst: 5000

# Forwarding via gRPC ke Falcosidekick
grpc:
  enabled: true
  bind_address: "unix:///var/run/falco/falco.sock"
  threadiness: 4

grpc_output:
  enabled: true

<!-- /var/ossec/etc/ossec.conf - Wazuh Worker Node -->
<ossec_config>
  <cluster>
    <name>wazuh-enterprise-cluster</name>
    <node_name>wazuh-worker-01</node_name>
    <node_type>worker</node_type>
    <key>4a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d</key>
    <port>1516</port>
    <bind_addr>0.0.0.0</bind_addr>
    <nodes>
      <node>198.51.100.10</node> <!-- Master Node IP Sintetis RFC 5737 -->
    </nodes>
    <hidden>no</hidden>
    <disabled>no</disabled>
  </cluster>

  <!-- Tuning Antrean Jaringan Skala Tinggi -->
  <remote>
    <connection>syslog</connection>
    <port>5140</port>
    <protocol>tcp</protocol>
    <allowed-ips>198.51.100.0/24</allowed-ips> <!-- Subnet Kluster K8s RFC 5737 -->
    <queue_size>262144</queue_size>
  </remote>

  <analysis>
    <memory_size>1048576</memory_size>
    <maximum_decoder_depth>10</maximum_decoder_depth>
  </analysis>

  <!-- Orkestrasi Respon Aktif Terintegrasi -->
  <command>
    <name>k8s-pod-quarantine</name>
    <executable>active-containment-orchestrator.sh</executable>
    <timeout_allowed>yes</timeout_allowed>
  </command>

  <active-response>
    <command>k8s-pod-quarantine</command>
    <location>local</location>
    <rules_id>100601,100602,100603</rules_id>
    <timeout>3600</timeout> <!-- Isolasi Jaringan 1 Jam -->
  </active-response>
</ossec_config>

<!-- /var/ossec/etc/rules/tetragon_falco_rules.xml -->
<group name="tetragon,falco,runtime_security,">
  <!-- Parent Rule: Tetragon In-Kernel Enforcement Event -->
  <rule id="100600" level="3">
    <decoded_as>json</decoded_as>
    <field name="process_kprobe.process.binary">\.+</field>
    <description>Tetragon runtime event captured.</description>
  </rule>

  <!-- Critical: In-Kernel SIGKILL Dijalankan oleh Tetragon -->
  <rule id="100601" level="14">
    <if_sid>100600</if_sid>
    <field name="action">KILLED_SIGKILL</field>
    <mitre>
      <id>T1059</id>
      <id>T1204</id>
    </mitre>
    <description>CRITICAL: Tetragon In-Kernel Enforcement mengeksekusi SIGKILL pada proses $(process_kprobe.process.binary) di Pod $(process_kprobe.process.pod.name) [Namespace: $(process_kprobe.process.pod.namespace)].</description>
  </rule>

  <!-- Critical: Upaya Privilege Escalation Digagalkan -->
  <rule id="100602" level="15">
    <if_sid>100600</if_sid>
    <field name="process_kprobe.function_name">commit_creds</field>
    <mitre>
      <id>T1068</id>
      <id>T1611</id>
    </mitre>
    <description>EMERGENCY: Upaya Kernel Privilege Escalation dicegat di Pod $(process_kprobe.process.pod.name)! Pengubahan UID ke 0 (root) digagalkan.</description>
  </rule>

  <!-- High: Penulisan Berkas Sensitif Diblokir via LSM -->
  <rule id="100603" level="13">
    <if_sid>100600</if_sid>
    <field name="process_lsm.function_name">security_file_open</field>
    <mitre>
      <id>T1003.008</id>
      <id>T1565</id>
    </mitre>
    <description>ALERT: In-Kernel LSM memblokir akses modifikasi berkas sensitif oleh proses $(process_lsm.process.binary).</description>
  </rule>
</group>

#!/usr/bin/env bash
# ==============================================================================
# SCRIPT: audit-kernel-security-runtime.sh
# AUTHOR: La Nina 🌊
# DESCRIPTION: Linux Kernel, eBPF LSM & Runtime Security Readiness Auditor
# DATA REF: 100% Synthetic RFC 5737 Compliant
# ==============================================================================
set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
BLUE='\033[0;34m'
NC='\033[0m'

echo -e "${BLUE}=================================================================${NC}"
echo -e "${BLUE}     LINUX KERNEL eBPF LSM & RUNTIME SECURITY READINESS AUDIT     ${NC}"
echo -e "${BLUE}=================================================================${NC}"

FAILURES=0
WARNINGS=0

# 1. Audit Versi Kernel Linux
KERNEL_VER=$(uname -r)
KERNEL_MAJOR=$(echo "$KERNEL_VER" | cut -d'.' -f1)
KERNEL_MINOR=$(echo "$KERNEL_VER" | cut -d'.' -f2)

echo -n "[*] Memeriksa Versi Kernel ($KERNEL_VER) >= 5.15 LTS... "
if [ "$KERNEL_MAJOR" -gt 5 ] || { [ "$KERNEL_MAJOR" -eq 5 ] && [ "$KERNEL_MINOR" -ge 15 ]; }; then
    echo -e "${GREEN}PASSED${NC}"
else
    echo -e "${RED}FAILED (eBPF LSM modern membutuhkan Linux Kernel >= 5.15)${NC}"
    FAILURES=$((FAILURES + 1))
fi

# 2. Audit Ketersediaan Kernel BTF
echo -n "[*] Memvalidasi Kernel BTF (/sys/kernel/btf/vmlinux)... "
if [ -f "/sys/kernel/btf/vmlinux" ]; then
    BTF_SIZE=$(stat -c%s "/sys/kernel/btf/vmlinux")
    echo -e "${GREEN}PASSED (${BTF_SIZE} bytes)${NC}"
else
    echo -e "${RED}FAILED (BTF tidak ditemukan! Kernel harus dikompilasi dengan CONFIG_DEBUG_INFO_BTF=y)${NC}"
    FAILURES=$((FAILURES + 1))
fi

# 3. Audit BPF LSM pada Boot Parameters
echo -n "[*] Memverifikasi Modul Aktif BPF LSM (/sys/kernel/security/lsm)... "
if [ -f "/sys/kernel/security/lsm" ]; then
    ACTIVE_LSM=$(cat /sys/kernel/security/lsm)
    echo -n "Ditemukan: [$ACTIVE_LSM] -> "
    if echo "$ACTIVE_LSM" | grep -q "bpf"; then
        echo -e "${GREEN}PASSED (bpf aktif)${NC}"
    else
        echo -e "${RED}FAILED ('bpf' belum terdaftar! Tambahkan lsm=...,bpf pada konfigurasi GRUB)${NC}"
        FAILURES=$((FAILURES + 1))
    fi
else
    echo -e "${YELLOW}WARNING (Securityfs belum di-mount)${NC}"
    WARNINGS=$((WARNINGS + 1))
fi

# 4. Audit Kompiler eBPF JIT & Hardening
echo -n "[*] Memeriksa eBPF JIT Compiler (net.core.bpf_jit_enable)... "
JIT_EN=$(sysctl -n net.core.bpf_jit_enable 2>/dev/null || echo "0")
if [ "$JIT_EN" -eq 1 ]; then
    echo -e "${GREEN}PASSED (Enabled)${NC}"
else
    echo -e "${RED}FAILED (JIT tidak aktif, performa kernel terdegradasi)${NC}"
    FAILURES=$((FAILURES + 1))
fi

echo -n "[*] Memeriksa JIT Blinding Hardening (net.core.bpf_jit_harden)... "
JIT_HARD=$(sysctl -n net.core.bpf_jit_harden 2>/dev/null || echo "0")
if [ "$JIT_HARD" -ge 1 ]; then
    echo -e "${GREEN}PASSED (Hardened: $JIT_HARD)${NC}"
else
    echo -e "${YELLOW}WARNING (JIT blinding belum diaktifkan terhadap JIT-spraying attacks)${NC}"
    WARNINGS=$((WARNINGS + 1))
fi

# 5. Audit Restriksi Unprivileged eBPF
echo -n "[*] Memeriksa kernel.unprivileged_bpf_disabled... "
UNPRIV_BPF=$(sysctl -n kernel.unprivileged_bpf_disabled 2>/dev/null || echo "0")
if [ "$UNPRIV_BPF" -ge 1 ]; then
    echo -e "${GREEN}PASSED (Dibatasi hanya untuk privileged users)${NC}"
else
    echo -e "${RED}FAILED (Unprivileged eBPF aktif! Berisiko terhadap local privilege escalation)${NC}"
    FAILURES=$((FAILURES + 1))
fi

# 6. Audit Titik Mount Cgroups v2 Unified
echo -n "[*] Memvalidasi Cgroups v2 Unified Hierarchy... "
if mount | grep -q "cgroup2 on /sys/fs/cgroup"; then
    echo -e "${GREEN}PASSED (Cgroups v2 Unified Aktif)${NC}"
else
    echo -e "${YELLOW}WARNING (Terdeteksi legacy Cgroups v1)${NC}"
    WARNINGS=$((WARNINGS + 1))
fi

# 7. Audit BPF Filesystem Mount
echo -n "[*] Memeriksa bpffs mount pada /sys/fs/bpf... "
if mount | grep -q "type bpf"; then
    echo -e "${GREEN}PASSED${NC}"
else
    echo -e "${RED}FAILED (/sys/fs/bpf belum di-mount! Persistensi peta Tetragon akan gagal)${NC}"
    FAILURES=$((FAILURES + 1))
fi

echo -e "\n${BLUE}=================================================================${NC}"
echo -e "Hasil Audit: ${GREEN}$((7 - FAILURES - WARNINGS)) Berhasil${NC} | ${YELLOW}${WARNINGS} Peringatan${NC} | ${RED}${FAILURES} Kegagalan Kritis${NC}"
if [ "$FAILURES" -gt 0 ]; then
    echo -e "${RED}[!] SISTEM BELUM MEMENUHI SYARAT IN-KERNEL ENFORCEMENT.${NC}"
    exit 1
else
    echo -e "${GREEN}[+] SISTEM SIAP UNTUK DEPLOYMENT CILIUM TETRAGON & FALCO PRODUKSI.${NC}"
    exit 0
fi

#!/usr/bin/env bash
# ==============================================================================
# SCRIPT: benchmark-ebpf-runtime-overhead.sh
# AUTHOR: La Nina 🌊
# DESCRIPTION: Benchmark CPU/Memory & Syscall Latency Overhead of In-Kernel Security
# DATA REF: 100% Synthetic Benchmark (RFC 5737 Compliant)
# ==============================================================================
set -euo pipefail

DURATION=10
TMP_DIR=$(mktemp -d /tmp/benchmark-ebpf.XXXXXX)
trap 'rm -rf "$TMP_DIR"' EXIT

echo -e "\033[0;34m[*] Memulai Benchmark Beban dan Latensi eBPF Runtime Security...\033[0m"

# 1. Uji Latensi Syscall Berfrekuensi Tinggi (100.000 iterasi stat/open)
echo -e "\n[+] Tahap 1: Benchmark Syscall Stat & Open/Close (100.000 iterasi)..."
python3 - <<EOF
import time
import os

iterations = 100000
start = time.perf_counter()
for _ in range(iterations):
    try:
        os.stat("/etc/hosts")
    except:
        pass
elapsed = time.perf_counter() - start
avg_lat_us = (elapsed / iterations) * 1_000_000
print(f"    Total Iterasi    : {iterations}")
print(f"    Waktu Eksekusi   : {elapsed:.4f} detik")
print(f"    Rata-rata Latensi: {avg_lat_us:.3f} mikrodetik / call")
print(f"    Throughput       : {iterations / elapsed:.0f} syscalls/detik")
EOF

# 2. Uji Pembuatan Proses & Eksekusi Execve (5.000 proses)
echo -e "\n[+] Tahap 2: Benchmark Fork & Execve Spawn (5.000 proses)..."
python3 - <<EOF
import time
import subprocess

iterations = 5000
start = time.perf_counter()
for _ in range(iterations):
    subprocess.run(["true"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
elapsed = time.perf_counter() - start
print(f"    Total Proses     : {iterations}")
print(f"    Waktu Eksekusi   : {elapsed:.4f} detik")
print(f"    Latensi Fork+Exec: {(elapsed / iterations) * 1000:.3f} ms / proses")
print(f"    Throughput       : {iterations / elapsed:.0f} proses/detik")
EOF

# 3. Inspeksi Program dan Peta BPF Aktif
echo -e "\n[+] Tahap 3: Memeriksa Jumlah Program BPF dan Hook LSM yang Aktif..."
if command -v bpftool >/dev/null 2>&1; then
    echo "    Total Program BPF Dimuat : $(bpftool prog show | grep -c 'type ')"
    echo "    Total Peta BPF Terdaftar : $(bpftool map show | grep -c 'type ')"
    echo "    Hook LSM Aktif           : $(bpftool prog show | grep -c 'type lsm' || echo 0)"
else
    echo "    [i] bpftool tidak terpasang, melewati inspeksi langsung kernel map."
fi

echo -e "\n\033[0;32m[+] Pengujian Benchmark Selesai dengan Sukses.\033[0m"

#!/usr/bin/env bash
# ==============================================================================
# SCRIPT: active-containment-orchestrator.sh
# AUTHOR: La Nina 🌊
# DESCRIPTION: Multi-Layer Automated Threat Containment (Wazuh Active Response Handler)
# DATA REF: 100% Synthetic RFC 5737 Compliant (Subnet 198.51.100.0/24)
# ==============================================================================
set -euo pipefail

LOG_FILE="/var/ossec/logs/active-responses.log"
INPUT_JSON=$(cat)

ACTION=$(echo "$INPUT_JSON" | jq -r '.command // "add"')
ALERT_ID=$(echo "$INPUT_JSON" | jq -r '.parameters.alert.id // "unknown"')
RULE_ID=$(echo "$INPUT_JSON" | jq -r '.parameters.alert.rule.id // "0"')
POD_NAME=$(echo "$INPUT_JSON" | jq -r '.parameters.alert.data.process_kprobe.process.pod.name // .parameters.alert.data.k8s.pod.name // empty')
NAMESPACE=$(echo "$INPUT_JSON" | jq -r '.parameters.alert.data.process_kprobe.process.pod.namespace // .parameters.alert.data.k8s.ns.name // "default"')
SRC_IP=$(echo "$INPUT_JSON" | jq -r '.parameters.alert.data.src_ip // empty')

log_msg() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') [CONTAINMENT] [Rule: $RULE_ID] $*" >> "$LOG_FILE"
}

log_msg "Invoked with Action: $ACTION for Pod: $POD_NAME (Namespace: $NAMESPACE)"

if [ "$ACTION" == "add" ]; then
    # 1. Karantina Jaringan Pod via Cilium NetworkPolicy
    if [ -n "$POD_NAME" ] && command -v kubectl >/dev/null 2>&1; then
        log_msg "Menegakkan Zero-Trust Network Isolation pada Pod $POD_NAME di $NAMESPACE..."
        
        cat <<EOF | kubectl apply -f - || log_msg "Gagal menerapkan quarantine CiliumNetworkPolicy"
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: quarantine-${POD_NAME}
  namespace: ${NAMESPACE}
spec:
  endpointSelector:
    matchLabels:
      io.kubernetes.pod.name: ${POD_NAME}
  ingress: []
  egress: [] # Blokir total (Sinkhole traffic)
EOF
        log_msg "Pod $POD_NAME berhasil diisolasi dari komunikasi jaringan kluster."
    fi

    # 2. Blokir Firewall Host untuk Alamat IP Penyerang Luar (RFC 5737 Synthetic C2)
    if [ -n "$SRC_IP" ] && [[ "$SRC_IP" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
        # Perlindungan whitelist loopback & private range
        if [[ "$SRC_IP" == "127.0.0.1" ]] || [[ "$SRC_IP" =~ ^10\. ]] || [[ "$SRC_IP" =~ ^192\.168\. ]]; then
            log_msg "Alamat IP $SRC_IP adalah segmen internal/privat. Melewati blokir host."
        else
            log_msg "Memblokir IP C2 berbahaya $SRC_IP via iptables host..."
            iptables -I FORWARD 1 -s "$SRC_IP" -j DROP || true
            iptables -I INPUT 1 -s "$SRC_IP" -j DROP || true
        fi
    fi

elif [ "$ACTION" == "delete" ]; then
    # Pemulihan Karantina
    if [ -n "$POD_NAME" ] && command -v kubectl >/dev/null 2>&1; then
        log_msg "Membatalkan kebijakan isolasi untuk Pod $POD_NAME..."
        kubectl delete ciliumnetworkpolicy "quarantine-${POD_NAME}" -n "$NAMESPACE" --ignore-not-found=true || true
    fi
fi

exit 0

[ 1420.312014] watchdog: BUG: soft lockup - CPU#4 stuck for 26s! [tetragon:4120]
[ 1420.312080] Call Trace:
[ 1420.312100]  <IRQ>
[ 1420.312120]  kprobe_dispatcher+0x42/0x80
[ 1420.312150]  kprobe_ftrace_handler+0x8a/0x110
[ 1420.312180]  __vfs_write+0x5/0x1c0
[ 1420.312210]  vfs_write+0xb8/0x1a0
[ 1420.312240]  ksys_write+0x5f/0xe0
[ 1420.312260]  do_syscall_64+0x5b/0x180

falco_drops: 184,210 events
falco_drops_ratio: 0.142 (14.2% syscall events dropped!)

Status:
  Conditions:
    - Message: "loading bpf program failed: permission denied: 84: (85) call bpf_send_signal#109: helper call is not allowed in probe type 28"
      Reason: BpfProgramLoadFailed
      Status: "False"
      Type: Ready

2026/09/14 14:10:02 wazuh-remoted: ERROR: Input queue is full (262144 items). Dropping incoming events.
2026/09/14 14:10:05 wazuh-analysisd: WARNING: Processing latency spike: 4200ms per event batch.