Kubernetes Security with Sysdig Secure

Risky image prevention via admission control

Block unscanned or vulnerable images from being deployed onto the cluster with the Sysdig Admission Controller plugin tool. Define criteria based on flexible conditions (i.e., namespace, CVE severity level, fix availability, image size, etc.) in order for the image to be approved.

Sysdig Secure also prevents vulnerabilities early by integrating image scanning into the CI/CD pipelines and registries.

Policy as Code using OPA

Leverage Open Policy Agent (OPA), the OSS standard for policy management, and apply policy as code controls across your Kubernetes workloads.

Validate cluster configuration based on CIS Benchmarks for Kubernetes and automate compliance and governance across Kubernetes environments.

Runtime threat detection for Kubernetes

Detect anomalous activity using community-driven policies (e.g., MITRE, FIM, cryptomining, etc.) based on open-source Falco. Create precise rules by using rich context from the cloud provider and Kubernetes environments.

Save time with out-of-the-box rules and machine learning-based image profiling instead of creating Kubernetes security policies from scratch. Alert on who did what at the Kubernetes API level based on API audit logs.

Kubernetes-native microsegmentation

Automatically generate least-privilege network policies using rich application and Kubernetes metadata. Visually confirm the topology before applying in production. Use a simple graphical interface to easily modify policies without manually changing the YAML.

Kubernetes incident response software

Gain deep visibility into apps and services in Kubernetes using dynamic topology maps.

Visualize syscall data (i.e., connections, latency, CPU usage, etc.) and perform incident response using granular data enriched with Kubernetes and cloud context.