Envoy collection

A collection to defend Envoy Gateway against common attacks:

• Envoy default access log format and JSON parser (CRI/containerd)
• base http scenarios (crawl, 404 scan, bf)

Acquisition template

Example acquisition for this collection:

1filenames:
2  - /path/to/file
3labels:
4  type: envoy

Example acquisition for Kubernetes (containerd/CRI):

1container_runtime: containerd
2agent:
3  acquisition:
4    - namespace: envoy-gateway-system
5      podName: envoy-envoy-gateway-system-envoy-gateway-*
6      program: envoy
7      poll_without_inotify: true