2026-11-09T06:13:33Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:13:33.586683425+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/calico proc_sname= gparent=<NA> proc_exe_ino_ctime=1794203385420700812 proc_exe_ino_mtime=1794203384969698646 proc_exe_ino_ctime_duration_proc_start=1428165601187 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=calico proc_exepath=/opt/cni/bin/calico parent=containerd command=calico terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=ec9af84c54ef57984356e5902556d732
2026-11-09T06:13:33Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:13:33.581072468+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/portmap proc_sname= gparent=<NA> proc_exe_ino_ctime=1794203387134709040 proc_exe_ino_mtime=1794203387128709011 proc_exe_ino_ctime_duration_proc_start=1426445994142 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=portmap proc_exepath=/opt/cni/bin/portmap parent=containerd command=portmap terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=08253721743ed4bcc80e9c4de462b401
2026-11-09T06:13:33Z INF event event="Contact K8S API Server From Container" output="2026-11-09T06:13:33.669210806+0000: Notice Unexpected connection to K8s API Server from container | connection=172.18.0.2:59496->10.96.0.1:443 lport=443 rport=59496 fd_type=ipv4 fd_proto=tcp evt_type=connect user=root user_uid=0 user_loginuid=-1 process=calico proc_exepath=/opt/cni/bin/calico parent=containerd command=calico terminal=0" priority=Notice source=syscall trace_id=aa8b249ea4cf41dd595354293e74ae43
2026-11-09T06:13:33Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:13:33.687313749+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/calico-ipam proc_sname= gparent=containerd proc_exe_ino_ctime=1794203386863707739 proc_exe_ino_mtime=1794203385745702372 proc_exe_ino_ctime_duration_proc_start=1426823338214 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=calico-ipam proc_exepath=/opt/cni/bin/calico-ipam parent=calico command=calico-ipam terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=ac5e5322b34d4b59ff0f522f312fcdee
2026-11-09T06:13:33Z INF action action="PB2 Quarantine Artifact" actionner=kubernetes:script event="2026-11-09T06:13:32.450198064+0000: Warning PR10 RESPONSE PB2 (pod=cible1 namespace=default processus=sh commande=sh -c PR10_PB2_RESPONSE=1; printf %s /tmp/manual-curl-tool.sh >/dev/null)" namespace=default pod=cible1 rule="PB2 File Quarantine Playbook" status=success trace_id=b3bb04eb8571d26d6e53fb93d36295d6
2026-11-09T06:13:33Z INF action action="PB2 Marker Complete" actionner=kubernetes:label event="2026-11-09T06:13:32.450198064+0000: Warning PR10 RESPONSE PB2 (pod=cible1 namespace=default processus=sh commande=sh -c PR10_PB2_RESPONSE=1; printf %s /tmp/manual-curl-tool.sh >/dev/null)" rule="PB2 File Quarantine Playbook" status=in_progress trace_id=b3bb04eb8571d26d6e53fb93d36295d6
2026-11-09T06:13:33Z INF notification action="PB2 Quarantine Artifact" actionner=kubernetes:script notifier=k8sevents rule="PB2 File Quarantine Playbook" stage=action status=success trace_id=b3bb04eb8571d26d6e53fb93d36295d6
2026-11-09T06:13:33Z INF event event="Contact K8S API Server From Container" output="2026-11-09T06:13:33.798485463+0000: Notice Unexpected connection to K8s API Server from container | connection=172.18.0.2:59512->10.96.0.1:443 lport=443 rport=59512 fd_type=ipv4 fd_proto=tcp evt_type=connect user=root user_uid=0 user_loginuid=-1 process=calico-ipam proc_exepath=/opt/cni/bin/calico-ipam parent=calico command=calico-ipam terminal=0" priority=Notice source=syscall trace_id=79c7fd07b895c858ddd989b063e7ce11
2026-11-09T06:13:33Z INF action action="PB2 Marker Complete" actionner=kubernetes:label event="2026-11-09T06:13:32.450198064+0000: Warning PR10 RESPONSE PB2 (pod=cible1 namespace=default processus=sh commande=sh -c PR10_PB2_RESPONSE=1; printf %s /tmp/manual-curl-tool.sh >/dev/null)" namespace=default output="the pod 'cible1' in the namespace 'default' has been labeled" pod=cible1 rule="PB2 File Quarantine Playbook" status=success trace_id=b3bb04eb8571d26d6e53fb93d36295d6
2026-11-09T06:13:33Z INF notification action="PB2 Marker Complete" actionner=kubernetes:label notifier=k8sevents rule="PB2 File Quarantine Playbook" stage=action status=success trace_id=b3bb04eb8571d26d6e53fb93d36295d6