Details
Content
Dependencies
Version History

This is an integration that will use Sysdig agent to respond to malicious activity by triggering different actions at the host or container level like killing a container, quarantine a file or perform a system capture

Sysdig Response Actions

This integration utilizes the Sysdig agent and the Sysdig Response Actions API to facilitate automated and manual remediation of security incidents. It enables security teams to take precise actions at the host or container level, such as terminating compromised containers, quarantining suspicious files, or capturing detailed system activity for forensic analysis. These capabilities are designed to enhance incident response workflows and improve overall security operations.

What does this pack do?

This pack leverages the Sysdig Response Actions API to enable automated and manual responses to security incidents. Key features include:

Container Management: Terminate malicious containers to prevent further damage.
File Quarantine: Isolate suspicious files to mitigate potential threats.
System Capture: Perform detailed system captures for forensic analysis.
Host-Level Actions: Execute commands or scripts on hosts to remediate issues.

These capabilities help streamline incident response and enhance security posture.

For more information, visit Sysdig.

Pack Contributors:

Sebastian Zumbado Herrera
Federico Barcelona Auria

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Sysdig Response Actions

What does this pack do?

This pack leverages the Sysdig Response Actions API to enable automated and manual responses to security incidents. Key features include:

Container Management: Terminate malicious containers to prevent further damage.
File Quarantine: Isolate suspicious files to mitigate potential threats.
System Capture: Perform detailed system captures for forensic analysis.
Host-Level Actions: Execute commands or scripts on hosts to remediate issues.

These capabilities help streamline incident response and enhance security posture.

For more information, visit Sysdig.

Pack Contributors:

Sebastian Zumbado Herrera
Federico Barcelona Auria

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Classifiers

Name	Description
Sysdig Mapper Runtime Event	Maps Sysdig Secure V2 webhook payload fields to Sysdig Runtime Event incident fields.

Incident Fields

Name	Description
Sysdig Source	The source of the event
Sysdig Process CWD	The current working directory of the process
Sysdig Event Type	The syscall event type
Sysdig Event URL	URL to the event in the Sysdig Secure console
Sysdig K8s Node Name	The Kubernetes node name
Sysdig Policy Version	The Sysdig policy version
Sysdig Agent Variant	The Sysdig agent variant
Sysdig Process SHA256	The SHA256 hash of the process binary
Sysdig Customer ID	The Sysdig Customer ID
Sysdig Falco Output	The Falco rule output with event details
Sysdig Origin	The origin of the policy event
Sysdig Aggregated	Whether the event is aggregated
Sysdig Event ID	The unique Sysdig policy event identifier
Sysdig Policy ID	The Sysdig policy ID
Sysdig Process Cmdline	The full command line of the process
Sysdig Username	The username associated with the process
Sysdig Process Parent Name	The parent process name
Sysdig AWS Region	The AWS region
Sysdig K8s Workload Type	The Kubernetes workload type
Sysdig K8s Cluster Name	The Kubernetes cluster name
Sysdig AWS Instance ID	The AWS EC2 instance ID
Sysdig Host ID	The unique host identifier from Sysdig
Sysdig K8s Workload Name	The Kubernetes workload name
Sysdig Agent ID	The Sysdig Agent ID
Sysdig Container Name	The container name where the event occurred
Sysdig Policy Name	The Sysdig policy name
Sysdig Container Image ID	The container image ID
Sysdig K8s Pod Name	The Kubernetes pod name
Sysdig Container Image Tag	The container image tag
Sysdig Container ID	The Sysdig Container ID
Sysdig AWS Account ID	The AWS account ID
Sysdig K8s Namespace	The Kubernetes namespace
Sysdig Process Name	The process name that triggered the event
Sysdig Rule Name	The Falco rule that triggered the event
Sysdig Container Image	The container image repository
Sysdig Agent Version	The Sysdig agent version on the host
Sysdig Rule Type	The type of rule that triggered the event

Incident Types

Name	Description
Sysdig Runtime Event

Integrations

Name	Description
Sysdig Response Actions (Partner Contribution)	Uses the Sysdig agent to respond to malicious activity by triggering different actions at the host or container level, such as killing a container, quarantining a file, or performing a system capture.

Layouts

Name	Description
Sysdig Incident

Playbooks

Name	Description
Sysdig Trigger System Capture	Enriches Sysdig runtime event incidents with agent information via API and optionally triggers a system capture on the affected host.

Classifiers

Name	Description
Sysdig Mapper Runtime Event	Maps Sysdig Secure V2 webhook payload fields to Sysdig Runtime Event incident fields.

Incident Fields

Name	Description
Sysdig AWS Region	The AWS region
Sysdig K8s Cluster Name	The Kubernetes cluster name
Sysdig K8s Workload Type	The Kubernetes workload type
Sysdig Aggregated	Whether the event is aggregated
Sysdig Policy ID	The Sysdig policy ID
Sysdig Container Image	The container image repository
Sysdig Event URL	URL to the event in the Sysdig Secure console
Sysdig Agent Variant	The Sysdig agent variant
Sysdig Host ID	The unique host identifier from Sysdig
Sysdig Source	The source of the event
Sysdig K8s Pod Name	The Kubernetes pod name
Sysdig Process Parent Name	The parent process name
Sysdig Container Name	The container name where the event occurred
Sysdig Process SHA256	The SHA256 hash of the process binary
Sysdig Container Image Tag	The container image tag
Sysdig Process CWD	The current working directory of the process
Sysdig Origin	The origin of the policy event
Sysdig Rule Type	The type of rule that triggered the event
Sysdig Customer ID	The Sysdig Customer ID
Sysdig Username	The username associated with the process
Sysdig AWS Account ID	The AWS account ID
Sysdig Agent Version	The Sysdig agent version on the host
Sysdig Container ID	The Sysdig Container ID
Sysdig K8s Namespace	The Kubernetes namespace
Sysdig Process Cmdline	The full command line of the process
Sysdig K8s Workload Name	The Kubernetes workload name
Sysdig Process Name	The process name that triggered the event
Sysdig Container Image ID	The container image ID
Sysdig Event Type	The syscall event type
Sysdig AWS Instance ID	The AWS EC2 instance ID
Sysdig Policy Version	The Sysdig policy version
Sysdig Falco Output	The Falco rule output with event details
Sysdig Agent ID	The Sysdig Agent ID
Sysdig Policy Name	The Sysdig policy name
Sysdig Rule Name	The Falco rule that triggered the event
Sysdig Event ID	The unique Sysdig policy event identifier
Sysdig K8s Node Name	The Kubernetes node name

Incident Types

Name	Description
Sysdig Runtime Event

Integrations

Name	Description
Sysdig Response Actions (Partner Contribution)	Uses the Sysdig agent to respond to malicious activity by triggering different actions at the host or container level, such as killing a container, quarantining a file, or performing a system capture.

Layouts

Name	Description
Sysdig Incident

Playbooks

Name	Description
Sysdig Trigger System Capture	Enriches Sysdig runtime event alerts with agent information via API and optionally triggers a system capture on the affected host.

Required Content Packs (3)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (1)

Pack Name	Pack By
Common Types	By: Cortex XSOAR

All level dependencies (4)

Pack Name	Pack By
Base	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR

2.0.0 - 11321938 (July 26, 2026)

Incident Fields

Sysdig Agent ID
Updated the field metadata: marked as unsearchable for scalability and aligned the fromVersion with the pack components.
Sysdig Container ID
Updated the field metadata: marked as unsearchable for scalability and aligned the fromVersion with the pack components.
Sysdig Customer ID
Updated the field metadata: marked as unsearchable for scalability and aligned the fromVersion with the pack components.
Sysdig Event ID
Added a new incident field for the Sysdig event identifier.
Sysdig Container Name
Added a new incident field for the container name.
Sysdig Container Image
Added a new incident field for the container image.
Sysdig Container Image Tag
Added a new incident field for the container image tag.
Sysdig Container Image ID
Added a new incident field for the container image ID.
Sysdig Host ID
Added a new incident field for the host ID.
Sysdig Agent Version
Added a new incident field for the Sysdig agent version.
Sysdig Agent Variant
Added a new incident field for the Sysdig agent variant.
Sysdig Rule Name
Added a new incident field for the Falco rule name.
Sysdig Rule Type
Added a new incident field for the Falco rule type.
Sysdig Policy ID
Added a new incident field for the policy ID.
Sysdig Policy Name
Added a new incident field for the policy name.
Sysdig Policy Version
Added a new incident field for the policy version.
Sysdig Falco Output
Added a new incident field for the Falco event output.
Sysdig Event URL
Added a new incident field for the Sysdig event URL.
Sysdig Source
Added a new incident field for the event source.
Sysdig Origin
Added a new incident field for the event origin.
Sysdig Aggregated
Added a new incident field indicating if the event is aggregated.
Sysdig K8s Cluster Name
Added a new incident field for the Kubernetes cluster name.
Sysdig K8s Namespace
Added a new incident field for the Kubernetes namespace.
Sysdig K8s Pod Name
Added a new incident field for the Kubernetes pod name.
Sysdig K8s Node Name
Added a new incident field for the Kubernetes node name.
Sysdig K8s Workload Name
Added a new incident field for the Kubernetes workload name.
Sysdig K8s Workload Type
Added a new incident field for the Kubernetes workload type.
Sysdig AWS Account ID
Added a new incident field for the AWS account ID.
Sysdig AWS Region
Added a new incident field for the AWS region.
Sysdig AWS Instance ID
Added a new incident field for the AWS instance ID.
Sysdig Process Name
Added a new incident field for the process name.
Sysdig Process Cmdline
Added a new incident field for the process command line.
Sysdig Process CWD
Added a new incident field for the process current working directory.
Sysdig Process SHA256
Added a new incident field for the process binary SHA256.
Sysdig Process Parent Name
Added a new incident field for the parent process name.
Sysdig Event Type
Added a new incident field for the event type.
Sysdig Username
Added a new incident field for the username associated with the event.

Integrations

Sysdig Response Actions

Added the sysdig-agent-info-get command: resolves a host MAC address to its Sysdig agent details (agent ID, customer ID, hostname) via the /api/agents/connected endpoint. Results are cached per MAC address with a 1-hour TTL.
Added the sysdig-customer-info-get command: retrieves the Sysdig customer ID and name via /api/users/me. Results are cached with a 1-hour TTL.
Added support for 22 new response action types in the execute-response-action command (DELETE_POD, ROLLOUT_RESTART, ISOLATE_NETWORK, GET_LOGS, IAM_QUARANTINE, CAPTURE, CLOUD_VOLUME_SNAPSHOT, FETCH_CLOUD_LOGS, and more) with per-action parameter validation.
Updated the Docker image to: demisto/python3:3.12.13.10116658.

Layouts

Sysdig Incident
Updated the Incident Info tab with logical sections: Sysdig Event Info, Container & Host, Kubernetes Context, Cloud Context, Process Details, and Falco Rule Output.
Added a Legacy Sysdig Fields section for backward compatibility (Agent ID, Customer ID).

Mappers

Sysdig Mapper Runtime Event

Updated the incoming mapper to match the Sysdig Secure V2 webhook payload structure (entities[0].policyEvents[0] and eventLabels). New mappings cover Kubernetes, AWS, container, process, and Falco rule context.
Added a severity transformer mapping Sysdig severity (0=highest, 7=lowest) to Cortex XSOAR severity (1-4), and timestamp conversion from microseconds to ISO date format.
Removed the mapping of Sysdig Agent ID and Sysdig Customer ID from the webhook payload as they are not present in the V2 format. These are now resolved automatically via the sysdig-agent-info-get command.

Playbooks

Sysdig Trigger System Capture

Added the automatic agent enrichment: the playbook now calls sysdig-agent-info-get to resolve the host MAC address to agent ID, customer ID, and hostname before triggering a system capture.
Updated the playbook validation to require only the MAC address (minimum field needed to resolve agent info via API).
Updated the agent_id, customer_id, and host_name to be sourced from the Sysdig API response instead of the webhook payload.

Related pull requests:
- 44899
- 44097

Download

1.0.1 - 6936977 (January 29, 2026)