feat(shield): add file_integrity_monitoring

Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>

Author: therealbobo

charts/shield/Chart.yaml

@@ -13,5 +13,5 @@ maintainers:
   - name: mavimo
     email: marcovito.moscaritolo@sysdig.com
 type: application
-version: 1.23.4
+version: 1.24.4
 appVersion: "1.0.0"

charts/shield/README.md

@@ -105,6 +105,7 @@ The following table lists the configurable parameters of the `shield` chart and
 | features.detections.kubernetes_audit.http_port                                                      | The port that will be used to expose the audit endpoints                                                                                                                                                                                                                                                                    | <code>6443</code>                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | features.detections.kubernetes_audit.excluded_namespaces                                            | The list of namespaces that will be excluded from the audit feature                                                                                                                                                                                                                                                         | <code>[]</code>                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | features.detections.kubernetes_audit.webhook_rules                                                  | List of rules used to determine if a request should be audited                                                                                                                                                                                                                                                              | <code>[{"apiGroups":["","apps","autoscaling","batch","networking.k8s.io","rbac.authorization.k8s.io","extensions"],"apiVersions":["*"],"operations":["*"],"resources":["*/*"],"scope":"*"}]</code>                                                                                                                                                                                                                                           |
+| features.detections.file_integrity_monitoring.enabled                                               |                                                                                                                                                                                                                                                                                                                             | <code>false</code>                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | features.investigations.activity_audit.enabled                                                      |                                                                                                                                                                                                                                                                                                                             | <code>false</code>                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | features.investigations.live_logs.enabled                                                           |                                                                                                                                                                                                                                                                                                                             | <code>false</code>                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | features.investigations.network_security.enabled                                                    | Enable the network security feature                                                                                                                                                                                                                                                                                         | <code>false</code>                                                                                                                                                                                                                                                                                                                                                                                                                           |

charts/shield/templates/host/_configmap_helpers.tpl

@@ -106,6 +106,8 @@ true
     (dict "enabled" .investigations.audit_tap.enabled)
   "drift_control"
     (dict "enabled" .detections.drift_control.enabled)
+  "file_integrity_monitoring"
+    (dict "enabled" .detections.file_integrity_monitoring.enabled)
   "jmx"
     (dict "enabled" (dig (include "host.monitor_key" .) "java_management_extensions" "enabled" false .))
   "live_logs"

charts/shield/tests/host/configmap-dragent-yaml_test.yaml

@@ -645,6 +645,11 @@ tests:
           pattern: |
             drift_control:
               enabled: false
+      - matchRegex:
+          path: data['dragent.yaml']
+          pattern: |
+            file_integrity_monitoring:
+              enabled: false
       - matchRegex:
           path: data['dragent.yaml']
           pattern: |
@@ -780,6 +785,19 @@ tests:
             malware_control:
               enabled: true
 
+  - it: Enable File Integrity Monitoring
+    set:
+      features:
+        detections:
+          file_integrity_monitoring:
+            enabled: true
+    asserts:
+      - matchRegex:
+          path: data['dragent.yaml']
+          pattern: |
+            file_integrity_monitoring:
+              enabled: true
+
   - it: Enable Network Security
     set:
       features:

charts/shield/values.schema.json

@@ -883,6 +883,9 @@
         },
         "kubernetes_audit": {
           "$ref": "#/$defs/FeatureGroupDetections/$defs/KubernetesAudit"
+        },
+        "file_integrity_monitoring": {
+          "$ref": "#/$defs/FeatureGroupDetections/$defs/FileIntegrityMonitoring"
         }
       },
       "$defs": {
@@ -972,6 +975,16 @@
               ]
             }
           }
+        },
+        "FileIntegrityMonitoring": {
+          "type": "object",
+          "additionalProperties": true,
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Specify if the File Integrity Monitoring feature is enabled"
+            }
+          }
         }
       }
     },

charts/shield/values.yaml

@@ -128,6 +128,8 @@ features:
           resources:
             - '*/*'
           scope: '*'
+    file_integrity_monitoring:
+      enabled: false
 
   investigations:
     activity_audit: