Kibana POD detected executing Dynamic Code Loading

[andrea-tomassi]

Tracee, running with default signatures list, detects the Kibana POD (original image from ELK) as a Threat.
We got that alert almost every seconds.
I think this is a false positive. How can I get rid of this alert without disabling the signature for all the remaining containers?
Is there some mechanism to avoid such a massive alerting?

Thanks

*** Detection ***
Time: 2022-09-21T12:02:48Z
Signature ID: TRC-4
Signature: Dynamic Code Loading
Data: map[]
Command: node
Hostname: kibana-plus-586

[itaysk]

Hi Andrea, thanks for the question
Right now there's no alert suppression built into tracee, but depending on how you actually consume the events, that alert management tool might have it. can you please share how you consume Tracee's alerts? did you configure it to send them somewhere?

[andrea-tomassi]

Hi,
at the moment I'm just producing a json output to evaluate the accuracy of the Threat Intelligence module itself.
So the best practice here is adding a further "intellicence" on top of Tracee Threat Intelligence module?
Can you please give me some example of alert management tools with false positive suppression?

Thanks