Multi-messenger Security: Adaptive Kubernetes SOC...
summary
An adaptive, node-local Kubernetes SOC is built from Kubescape node agent for behavior profiles, Pixie live-compiled eBPF probes for edge compute and on‑demand instrumentation, and ClickHouse for forensic storage, and it reliably detects a supply‑chain io_uring rootkit hidden inside a noisy ClickHouse NodeJS process by flagging a new io_uring register syscall, tracing TCP connections to a C2, and deploying a dcache probe that reveals reads of /etc/shadow and service account tokens. Data never leaves the cluster and the demo works end to end.
AI-written summary · about
chapters (15)
- 0:00Multi-messenger security intro
- 1:03Security and observability tools
- 3:33Modern SOC requirements
- 5:19Pixie for SOC needs
- 7:08Adaptive SOC stack
- 9:34Rootkit detection demo setup
- 12:02Anomalies in infected stack
- 13:50Suspicious network traffic
- 15:59Call stack anomalies
- 17:24On-demand BPF probes
- 18:26File ops and data exfiltration
- 19:53Detection and investigation recap
- 20:33Adaptive SOC benefits
- 21:40Beyond Kubernetes environments
- 22:03Open source lab and research
related talks
37mProactive Kubernetes Security: Anomaly Detection and Runtime Alertin...
40mArchitecting Secure Agentic Workflows on Kubernetes: A Financial Sector...
20mUncovering a Sophisticated Kubernetes Attack in Real-Time
22mSecurity Showdown: The Overconfident Operator Vs the Nefarious...
36mHow to Prevent Your Kubernetes Cluster From Being Hacked — Nico Meisenzahl and Philip Welz
42mImproving Containers Isolation in Kubernetes
30mPod Security as an Afterthought
30mA Monitoring Platform for Kubernetes Cluster Security