Four Alerts, Zero Understanding

▶ Watch (0:51)

A WAF sees an SQL injection. An eBPF probe sees a process execution. Kubernetes sees API calls. Cloud security sees IAM activity. Four tools, four alerts, same attack. None of them know what the others saw. A real attack doesn’t respect those layers. The signal is already there, but it’s fragmented across tools that have no shared context. Moving from disconnected events to a coherent incident story is the problem Bertschy is trying to solve.

Application Profiles as Behavioral Contracts

▶ Watch (2:30)

Every cloud-native workload has predictable behavior: specific syscalls, processes, files, and network destinations. Bertschy calls this the application profile, a Kubernetes CRD that captures what the workload actually does at runtime. It’s not machine learning inference. It’s a signed, observable record. When a reverse shell spawns after an HTTP POST, the exec and connect syscalls weren’t in the profile. The application handler that started a child web process wasn’t either. Those two deviations are the attack.

CADR: Correlating Signals into an Attack Graph

▶ Watch (5:43)

CADR (Cloud Native Application Detection and Response) is the connecting layer. An HTTP injection, a process tree, Kubernetes resource manipulation, and an AWS IAM event are individually ambiguous. Each one could be noise. Correlated and mapped against the application profile, they become a single attack graph: initial compromise, credential access, tool installation. The goal is to replace four uncertain alerts with one high-confidence finding that explains the full incident sequence.

RemOps: Kubernetes-Native Automated Response

▶ Watch (9:34)

High-confidence detection makes automated response possible. RemOps is Bertschy’s term for declarative remediation using Kubernetes constructs. The sequence: patch the network policy to isolate the pod, rotate the service account token, apply a secondary seccomp profile to restrict the attack surface, then roll back the deployment or trigger a GitOps reconcile. The pod stays observable during isolation. Each action is scoped to what the cluster already knows how to do, with no custom enforcement plane required.

7-Second Containment and Workload Hardening

▶ Watch (11:36)

With CADR running, injection to containment takes 7 seconds. The last step is reinforcement: applying a secondary seccomp profile after an incident limits what an attacker can do on the next attempt. Bertschy frames CADR as an open architecture, composable from existing CNCF tools with no proprietary enforcement plane. The framework does not add sensors. It connects the signals already flowing from eBPF, Kubescape, and the Kubernetes API.

Q&A

What tools exist today for cross-layer correlation? Full correlation tooling doesn’t exist yet. Kubescape has application profiles and runtime alerting, but the intelligence layer connecting them is missing. Bertschy framed this as a call to action for the industry. ▶ 14:53

How do SBOBs differ from application profiles? Application profiles are environment-specific; a profile from GKE deployed on EKS produces false positives because service account token paths and load balancer addresses differ. SBOBs generalize profiles across environments in a safe way, reducing both false positives and false negatives. The European CRA may require vendors to ship SBOBs alongside SBOMs. ▶ 15:46

Must all correlated signals be present before triggering remediation? Yes. A confidence aggregation layer should collect and graph individual events first, then trigger automated remediation only when the full picture is clear. Low-level remediations outside the Kubernetes cluster may also be needed in some cases. ▶ 18:05

Notable Quotes

incident, it doesn’t respect the layers. Matthias Bertschy · ▶ 00:53

This is not just machine learning magic. Matthias Bertschy · ▶ 08:11

This is a declaration based on facts. Matthias Bertschy · ▶ 08:14

So yeah, injection to containment 7 seconds. Matthias Bertschy · ▶ 11:43

Key Takeaways

  • Four isolated security layers each see a fragment; only correlation reveals a real attack.
  • Application profiles are signed Kubernetes CRDs derived from actual runtime behavior, not machine learning guesses.
  • RemOps executes declarative Kubernetes remediation automatically when detection confidence is high.
  • CADR reduces injection-to-containment time to 7 seconds and hardens the workload after each incident.
  • SBOBs generalize application profiles across environments, targeting portability and CRA compliance requirements.

About the Speaker

Matthias Bertschy is a Senior Kubernetes Developer at ARMO and a CNCF maintainer of Kubescape, Pro, and Inspector Gadget. He has been contributing to Kubernetes since 2016 as a SIG Node member and kubelet reviewer. He holds a GPEN (Ethical Hacker) certification from 2012 and a CISSP from 2015, and has spent five years helping Swiss banks run digital transformations as a Senior DevOps Engineer and Platform Architect.