> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# System procs network activity

### Event Information

#### Meaning

* The System procs network activity event in a Kubernetes cluster indicates that there is suspicious network activity happening within the system processes.
* It could be a sign of a potential security breach or unauthorized network communication.
* This event should be investigated further to identify the source of the network activity and take appropriate actions to mitigate any potential risks.

#### Remediation

1. Create a Kubernetes Deployment manifest file to deploy a Python script as a container:

```yaml theme={null}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: remediation-script
spec:
  replicas: 1
  selector:
    matchLabels:
      app: remediation-script
  template:
    metadata:
      labels:
        app: remediation-script
    spec:
      containers:
      - name: remediation-script
        image: python:3
        command: ["python", "-u"]
        args: ["remediation_script.py"]
        volumeMounts:
        - name: shared-data
          mountPath: /data
      volumes:
      - name: shared-data
        emptyDir: {}
```

2. Create a Kubernetes Service manifest file to expose the deployment:

```yaml theme={null}
apiVersion: v1
kind: Service
metadata:
  name: remediation-script-service
spec:
  selector:
    app: remediation-script
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80
```

3. Create a Python script named `remediation_script.py` that performs the necessary remediation actions:

```python theme={null}
# Add your remediation logic here
```

To remediate the event, you can follow these steps:

* Apply the Deployment manifest file using the `kubectl apply -f deployment.yaml` command.

* Apply the Service manifest file using the `kubectl apply -f service.yaml` command.

* Update the `remediation_script.py` file with the necessary remediation logic.

* Access the remediation script by using the Service's ClusterIP or NodePort, depending on your network setup.

* Monitor the logs of the remediation script container to ensure it is running and performing the desired actions.