Page History

...

Observability & Monitoring use-cases

Security Event Monitoring:

1. File Integrity Monitoring: Any changes to the systems folders should be monitored/audited.
2. Reverse Shell execution
3. Use of security sensitive primitives: setuid(), setguid(),chmod(),chown(),
4. Updates to root certificates folder
5. Use of kubectl exec  to gain shell access in the pod
6. Privilege escalation attempted
7. Monitor for external networks access
8. Suspicious IP detection (for e.g. using Feodo Blocked IP List)
9. Monitor for use of DGA (Domain Generation Algorithms) in the workload

...

1. Excessive CPU usage: >90% of CPU used consistently for > 2 mins
2. Excessive Memory usage: >80% of allocated memory used
3. ...

Goals

Components

• Open Horizon - to deliver and manage running workloads
• KubeArmor - to monitor and enforce security policy on host and workloads
• HomeAssistant - example service

Protection: Hardening use-cases

...