Proxmox VE
Free · OSSHypervisor
VM-lifecycle visibility for the post-VMware migration target.
Proxmox VE homepage ↗Open-source virtualization platform — the post-Broadcom-VMware migration target for SMBs. Cluster-wide audit events from the API give you VM lifecycle visibility.
What it watches
- Cluster-wide task log — VM create/destroy/migrate/clone
- Authentication + API-token events on the web UI
- Storage + backup-job events
- Config changes to VMs + the cluster
- Console + SPICE/VNC access events
MITRE ATT&CK coverage
Tactics this connector gives CyberCLI visibility into.
Every alert this connector surfaces
13 event types
Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix.
The right column shows the operator-friendly phrase the dashboard renders. High-severity
AI-lane signals are summarized in What it watches above (Warden + Herald
handle those); the rest take the substrate's passthrough lane (no AI tokens burned).
| event_type | dashboard renders |
|---|---|
| pve_login_failed | Hypervisor login failed on proxmox |
| pve_login | Hypervisor login on proxmox |
| pve_auth_failed | Proxmox auth failed on proxmox |
| pve_ct_lifecycle | Container lifecycle on proxmox |
| pve_vm_lifecycle | VM lifecycle on proxmox |
| pve_firewall_change | Hypervisor firewall change on proxmox |
| pve_identity_admin | Hypervisor identity admin on proxmox |
| pve_storage_admin | Hypervisor storage admin on proxmox |
| pve_rate_limited | Proxmox rate-limited on proxmox |
| pve_server_error | Proxmox server error on proxmox |
| pve_read | Proxmox read on proxmox |
| pve_api_other | Proxmox API call on proxmox |
| pve_malformed | Malformed Proxmox log on proxmox |
What it helps you catch
What you'd see in CyberCLI
illustrativeCatches an attacker cloning or exporting a VM disk image — exfil at the hypervisor layer.
Routed to Warden (triage) → Knight (detection)
⛓ every step hash-chained · replayable
What CyberCLI reads from Proxmox VE
audit our mathProxmox tails the pveproxy access log. The 13 fields carry the HTTP frame (method, URI, status, bytes), the caller (src_ip, user_id, pve_realm, pve_principal split on the last at-sign so root@pam never collides with a local user), and a classified pve_api_class from URI plus status (vm_lifecycle, ct_lifecycle, identity_admin, firewall_change, storage_admin, login_failed). Enough to answer who spun up which VM, who tried to delete a storage pool, and whose token is being brute-forced.
Full field index · 13 fields ↓
.action.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_raw_line.cybercli_wire_format.detail.event_id.event_type.pve_api_class.pve_principal.rule_level.user_id MITRE techniques typically mapped
Trust Ladder ceiling · L0 → L3
- ·L0–L2: digest pveproxy events, notify on identity_admin / firewall_change / unusual vm_lifecycle, summarize login-failure bursts for the case
- ·L3 (Knight verification): correlate the principal against M365/Tailscale identity, geo-IP the src_ip, query the PVE API for cluster + VM state — read-only
- ·L4+: VM/CT stop/destroy, snapshot revert, storage pool changes — hypervisor-side blast radius stays operator-owned
- ·Any RBAC edit (user/group/role/ACL) or firewall-rule change — the surface attackers target for persistence
Full ladder semantics · /trust →
Field count + sample event auto-derived from src/cybercli/connectors/proxmoxve/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.
Close more of the kill chain
Proxmox VE covers 2 of 14 ATT&CK tactics. Pair it with these to widen coverage:
How to connect
- 1 Create a read-only API token (Datacenter → Permissions → API Tokens).
- 2 Run `cybercli onboard proxmox` with the host + token (vault-stored).
- 3 CyberCLI polls the cluster API for task + audit events.
- 4 Confirm in the dashboard's Connectors panel.
Download ISO from proxmox.com · install to bare-metal · `cybercli onboard proxmox`
Fully local. Proxmox runs on your hardware; CyberCLI reads its API over the LAN.