Lab

Isovalent Runtime Security: Splunk Integration

Leverage Isovalent Runtime Security with Splunk for advanced threat detection, CVE exploitation monitoring, and real-time attack mitigation

Learn how to integrate Isovalent Runtime Security with Splunk to create a comprehensive security observability and enforcement platform.

In this hands-on lab, you'll deploy a vulnerable Tomcat application and use Isovalent's eBPF-based runtime security capabilities to:

• Monitor identity-aware process and network events in real-time
• Correlate security data with third-party CVE databases in Splunk
• Detect and visualize CVE-2020-9484 exploitation attempts
• Implement distributed exploit protection using Tetragon TracingPolicies
• Analyze attack patterns and process ancestry trees in Splunk dashboards

You'll experience the complete security lifecycle from vulnerability discovery to threat mitigation, using Vector for log shipping and Splunk's powerful analytics to gain deep insights into runtime behavior. This expert-level lab demonstrates how Isovalent and Splunk work together to provide compensating runtime controls and advanced threat detection for cloud-native environments.

• 🪐 Deploy Isovalent + Splunk Together

  Explore the lab's environment

• 🚀 Collecting and Visualizing Security Data

  Now with our application deployed, how do we extract data?

• 🛡 Blocking the Attack

  Let's deploy a policy to protect our workload

• 🧪 Exam: Putting It All Together

  How do we analyze and block events with Splunk?