Cloud Native Threat Intelligence for...
summary
Kubernetes Storm Centre runs federated honey-clusters that collect eBPF and app logs, normalizes them to STIX observables, and maps matches via SQL/regex indicators into attack trees stored in a graph DB. A demo steals a managed identity token, uses the cloudsql connector proxy and psql to read a database (tokens live ~3,600s), showing token theft is often invisible. An exposed Leaky Vessel runSE honeypot saw C2 scans but no exploit. AI assists by classifying gigabytes of logs and auto-suggesting indicators.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:49Threat intelligence in Kubernetes
- 6:40Threat measurement framework
- 11:39Token theft detection
- 16:27Token exposure demo
- 24:01Calibration and testing
- 29:16AI-assisted detection
- 31:43Open source next steps
- 32:30Q&A
related talks
56mUnify cloud security from code to runtime with CrowdStrike and Bionic
50mThe Anatomy of Cloud Attacks
30mBuilding Effective Attack Detection in the Cloud
34mCloud Native Security: A New Paradigm for a New World
35mCloud Native Security for the Rest of Us
41mCloud Native Security For The Rest Of Us
21mMake threats visible in your cloud environment — Eric Jung
56mNavigating the Cloud Native Security Landscape