Blast radius at the server side layer

# ABOUTME: Falco runtime rules for agent Pods. Shell spawn, sensitive-path writes, non-allowlisted egress.
# ABOUTME: agent_pod macro matches namespaces matching agent-*; align with the namespace label from controls/identity/server-side/namespace.yaml.
- macro: agent_pod
  condition: k8s.ns.name startswith "agent-"

- list: allowed_agent_egress_ips
  items:
    # Populate from the FQDN allowlist in controls/supply-chain/server-side/cilium-mcp-fqdn-egress.yaml
    # by resolving the names; refresh nightly via a CronJob.
    - "0.0.0.0"   # placeholder; replace

- rule: Agent Container Spawned Shell
  desc: Agent containers should not spawn interactive shells
  condition: >
    spawned_process and agent_pod
    and proc.name in (sh, bash, zsh, fish, dash)
    and proc.tty != 0
  output: >
    Agent pod spawned shell
    (pod=%k8s.pod.name container=%container.name cmd=%proc.cmdline)
  priority: WARNING
  tags: [agent, blast_radius]

- rule: Agent Container Wrote to Sensitive Path
  desc: Agent container writing to /etc, /var/lib, or /usr
  condition: >
    open_write and agent_pod
    and (fd.name startswith /etc
         or fd.name startswith /var/lib
         or fd.name startswith /usr)
  output: >
    Agent pod wrote to sensitive path
    (pod=%k8s.pod.name file=%fd.name)
  priority: ERROR
  tags: [agent, blast_radius]

- rule: Agent Container Outbound to Non-Allowlisted Host
  desc: Agent egress to a host outside the per-agent allowlist
  condition: >
    outbound and agent_pod
    and not fd.sip in (allowed_agent_egress_ips)
  output: >
    Agent pod outbound to non-allowlisted
    (pod=%k8s.pod.name dest=%fd.sip:%fd.sport)
  priority: WARNING
  tags: [agent, blast_radius, supply_chain]

- rule: Agent Container Attempted Privilege Escalation
  desc: Agent container called setuid, setgid, or modified capabilities
  condition: >
    evt.type in (setuid, setgid, capset)
    and agent_pod
  output: >
    Agent privilege-escalation syscall
    (pod=%k8s.pod.name syscall=%evt.type)
  priority: ERROR
  tags: [agent, sandbox, blast_radius]

#!/usr/bin/env bash
# ABOUTME: Pipes Hubble flow drops to the SIEM as JSON. Run as a long-running systemd service or DaemonSet sidecar.
# ABOUTME: Without flow export wired up, Hubble is visible only in its own UI and provides no SIEM signal.

set -euo pipefail

SIEM_URL="${SIEM_URL:-https://siem.example.com:9200/agent-sentinel-network/_doc}"
SIEM_TOKEN="${SIEM_TOKEN:?Set SIEM_TOKEN in the environment.}"
NAMESPACE_FILTER="${NAMESPACE_FILTER:-agent-}"

# Stream drops only; allowed flows are too noisy. Add --type policy-verdict
# if you want allow flows for forensic baselining.
hubble observe --type drop --output json --follow --namespace "${NAMESPACE_FILTER}" \
| while IFS= read -r line; do
  curl -sS -X POST "$SIEM_URL" \
    -H "Authorization: Bearer ${SIEM_TOKEN}" \
    -H "Content-Type: application/json" \
    -d "$line" \
    >/dev/null
done

# ABOUTME: Prometheus AlertManager rules firing when an agent namespace hits 85%/95% of its ResourceQuota.
# ABOUTME: Pair with kube-state-metrics; the kube_resourcequota series is what these expressions read.
groups:
- name: agent-namespace-quota
  rules:

  - alert: AgentNamespaceQuotaApproaching
    expr: |
      (kube_resourcequota{namespace=~"agent-.*",resource="requests.cpu",type="used"}
        / kube_resourcequota{namespace=~"agent-.*",resource="requests.cpu",type="hard"}) > 0.85
    for: 5m
    labels:
      severity: warning
      framework: agentic-sentinels
    annotations:
      summary: "Agent namespace {{ $labels.namespace }} CPU quota at >85% for 5m"
      description: |
        Namespace {{ $labels.namespace }} has been consuming over 85% of its
        ResourceQuota.requests.cpu for the last 5 minutes. This is the early
        warning. Either scale capacity or investigate runaway agent.
      runbook: "https://runbooks.example.com/agent-quota-approaching"

  - alert: AgentNamespaceQuotaExceeded
    expr: |
      (kube_resourcequota{namespace=~"agent-.*",resource="requests.cpu",type="used"}
        / kube_resourcequota{namespace=~"agent-.*",resource="requests.cpu",type="hard"}) > 0.95
    for: 1m
    labels:
      severity: critical
      framework: agentic-sentinels
    annotations:
      summary: "Agent namespace {{ $labels.namespace }} CPU quota at >95%"
      description: |
        New Pod admissions in {{ $labels.namespace }} are likely failing.
        Investigate immediately.
      runbook: "https://runbooks.example.com/agent-quota-exceeded"

  - alert: AgentNamespaceMemoryQuotaApproaching
    expr: |
      (kube_resourcequota{namespace=~"agent-.*",resource="requests.memory",type="used"}
        / kube_resourcequota{namespace=~"agent-.*",resource="requests.memory",type="hard"}) > 0.85
    for: 5m
    labels:
      severity: warning
      framework: agentic-sentinels
    annotations:
      summary: "Agent namespace {{ $labels.namespace }} memory quota at >85% for 5m"

501 bytes. Too large to inline; open it on GitHub.