Lab

Isovalent Enterprise: Security Visibility

Let's use Isovalent Enterprise to view security events in a Kubernetes cluster.

In this scenario, we are going to simulate the exploitation of a nodejs application, with the attacker spawning a reverse shell inside of a container and moving laterally within the Kubernetes environment.

We will demonstrate how the combined Process and Network Event Data:

• identify the suspicious Late Process Execution
• tie the suspicious processes to a randomly generated External Domain Name
• trace the Lateral Movement and Data Exfiltration of the attacker post-exploit

• 🏛️ The Lab Environment

  Explore the lab's environment

• 🚀 Deploying a demo app

  Let's deploy the demo app!

• 👓 Explore Process and Network Events

  Now with our application deployed, how do we view events?

• 👨🏻‍💻 Observe security events as raw JSON

  How do we see events as JSON?

• 🔍 Application Model Analysis with CLI

  Let's analyze process relationships using Tetragon Application Model!

• 📊 Application Model Data Aggregation

  Let's aggregate application model data using Vector and the Tetragon aggregator!

• 🥋 Exam

  Time to use your knowledge!