{"id":17226395,"url":"https://github.com/kernc/containersec","last_synced_at":"2025-10-30T00:48:44.328Z","repository":{"id":141496453,"uuid":"471817629","full_name":"kernc/Containersec","owner":"kernc","description":null,"archived":false,"fork":false,"pushed_at":"2022-06-06T20:24:45.000Z","size":20,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-10-30T00:48:43.605Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kernc.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-03-19T21:35:23.000Z","updated_at":"2025-10-04T22:47:15.000Z","dependencies_parsed_at":"2023-07-03T15:31:34.291Z","dependency_job_id":null,"html_url":"https://github.com/kernc/Containersec","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/kernc/Containersec","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kernc%2FContainersec","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kernc%2FContainersec/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kernc%2FContainersec/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kernc%2FContainersec/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kernc","download_url":"https://codeload.github.com/kernc/Containersec/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kernc%2FContainersec/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":281726183,"owners_count":26550920,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-29T02:00:06.901Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-15T04:16:05.670Z","updated_at":"2025-10-30T00:48:44.283Z","avatar_url":"https://github.com/kernc.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"_Containersec_\n==============\nAutomated cloud-native AI container security monitoring and\nintrusion/hacking/threat detection/response system.\n\n**This software is strictly in a _proof-of-concept_ stage.**\nIt comes with no code quality assurances, and it has been tested only\non the provided _Dockerfile_ (see section _Usage_ below).\n\nWelcome to play with it and report your findings!\n\nInstallation\n------------\n```shell\n$ sudo apt install sysdig python3-pip\n\n$ pip install -r requirements.txt\n```\n\nUsage\n-----\nBasic mode of operation:\n```shell\n# Run the observer daemon with an sysdig filter appropriate for your\n# program/app and collect events into a training file.  While step 1 is\n# executing, run your program/app's test suite or stress-test it with\n# other valid (expected) traffic/payload/syscalls.\n$ ./sysdig.sh \"proc.apid in (SOME_PID, ...) or container.id in (SOME_ID, ...)\" | tee train.tsv\n\n# After collection, build a statistical model based on your training data.\n$ ./train.py train.tsv model.pickle\n\n# Re-run ./sysdig.sh with the same filter, but this time pipe its output\n# through ./detect.py and provide the trained model file.  The latter script\n# will print on stdout only events that are considered an anomaly (e.g. an attack),\n# and the rest to stderr.\n$ ./sysdig.sh ... | ./detect.py - model.pickle 2\u003e/dev/null\n```\nThat's it.\n\nIn general, and for arbitrary data sources (e.g. logs):\n```shell\n$ TSV_SOURCE | ./train.py - model.pickle\n$ TSV_SOURCE | ./detect.py - model.pickle 2\u003e/dev/null\n```\nNote, **first column is reserved for the _line source identifier_**\n(PID, container id etc.) and is ignored in the model.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkernc%2Fcontainersec","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkernc%2Fcontainersec","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkernc%2Fcontainersec/lists"}