Through CSG, you can easily deal with various cloud-native application threats and risks. The function features are as follows:

Dashboard

The dashboard displays the number statistics, deployment security information, and security threat distribution of important assets such as images, containers, nodes, image repositories, and clusters through visualized icons. It presents asset information statistics, vulnerability information statistics, and alarm information more intuitively. This enables customers to swiftly identify and comprehend potential threat scenarios.

Trends and History

Visual interfaces and reports are provided to showcase pertinent statistical data, trends, and other threat intelligence information. This aids decision makers in comprehending the current threat landscape and its trends.

Alarm and Event Management

The integrated alarm and event management system provides a summarized display of security events and alarm information on a large screen and offers fast event processing and tracking functions.

Asset Management

Detailed information about each asset, including cluster assets, node assets, namespaces, workloads, and more, are presented to help you understand the characteristics and configuration of each asset comprehensively.

Vulnerability Data Integration and Visualization

The vulnerability scanning result data is integrated and the vulnerability distribution and statistical information are showcased in visually. This assists users in gaining a thorough understanding of the vulnerability situation.

Alarm Response Center

The system monitors the operation of the containers in real time, captures and issues alarms for any potential abnormal behaviors, and provides security suggestions for different invasion behaviors. You can view specific information on all invasion events in the response center. Support the response center to perform various operations on containers with different statuses, such as disisolating, starting containers, isolating containers, terminating containers, pausing containers, and one-click closure.

Monitoring of Multiple Risk Behaviors

Support the detection of various risky behaviors such as starting privileged containers, container escape behaviors, reading sensitive files, starting malicious processes, mounting invalid devices, mapping sensitive directories, bouncing SHELL connection operations, and modifying namespaces.

Pod Isolation

Support network isolation control of communication between pods within a Kubernetes cluster.

Display at the ATT&CK Model Perspective

Information about each stage of the attack is displayed from the perspective of the attacker, reflecting the attack life cycle and the goals of each stage of the attack.

One-key Blocking

When an abnormal IP appears in the production environment, a one-key blocking feature can be utilized to prevent further damage by blocking the IP.

Image Security

Image is the basis of container operation. Any potential securities or risks security risks directly impact the container environment. Therefore, for potential security issues in the image, it is essential to automatically or manually scan image assets in the service environment host and the image repository to identify risks, block dangerous images based on policies, and provide suggestions for fixing high-risk images that can be written in the Dockerfile. Support all-round monitoring and detection of container image production process, image operation, and image release. This function enables automatic acquisition of images in nodes and repositories as well as scanning of images from multiple dimensions such as CVE vulnerabilities, CNNVD vulnerabilities, Trojan horse viruses, suspicious historical operations, sensitive information leakage, and whether they are trusted images.

Identification and Processing of Image Operation Risks

The security policy for image operation can be set to prohibit the operation of images that do not comply with the security policy. The security policy includes disallowing the starting as a root user, prohibiting Trojan horse viruses in images, and preventing images with specific software vulnerabilities.

Adaptation to Multiple Image Repositories

The platform supports synchronous adaption to various image repositories such as Harbor, JForg, Huawei, and Registry to cater to different use scenarios of the user.

Fast Image Scanning

The image scanning is fast with accurate results. It only takes 10 seconds to scan images of 10 GB.

Deep Image File and Software Package Detection

Add the scanning of third-party dependent libraries, Web framework libraries, virus Trojan horses, and other malicious files based on fast scanning to further ensure the security of image assets.

One-click Generation of Image Reports

Upon completion of image scanning, you can effortlessly generate image compliance inspection reports. These reports provide an overview of risk information, lists of risky images, vulnerability details, and suggestions for risk mitigation.

Security Traceability

The security risk information introduced in the image history is detected in real time, including the construction command of the image layer, operation time, introduced security issues, and other information.

Container Security

Ensuring the security of the container during runtime is the top priority in container security management and control. The traditional invasion detection methods are mainly aimed at the host or network level and existing methods cannot quickly detect the invasion behavior at the container level. Although the management platform provided by the traditional cloud platform can view the status of the container and isolate the container, it cannot provide continuous monitoring and real-time alarms for abnormal behaviors that may occur at any time. If the early warning and real-time alarm cannot be set, the intruder is very likely to remotely operate the container to execute commands through the vulnerability to achieve invasion, resulting in important data leakage.

Support detection of behavior within containers. When malicious behaviors such as container escape behaviors, reading sensitive information, starting malicious processes, mounting invalid devices, mapping sensitive directories, and modifying namespaces are found, an alarm is triggered or the operation of the container is blocked according to the preset policy. In addition, the abnormal pod deleted is isolated.

Custom Policy

Allow you to configure detection rules by dimensions such as clusters, namespaces, and nodes based on your production scenarios.

Container File Protection

Through the learning of the reading and writing behavior of files in the container, a trustlist of file read and write behaviors in the container is created, and all abnormal read and write behaviors in the container are identified with an alarm reported in time.

Data Forensics

Monitor and record the running process of the container to quickly find the source of attacks and troubleshoot in a timely manner when tracing the source of risky behaviors.

Container Runtime Monitoring

Support real-time detection of the CPU usage and memory usage in the running container.

Node Security

After the cluster is deployed, the operation and maintenance (O&M) personnel need to always pay attention to the online status of the Master and Node in the cluster, and whether there are security risks. For nodes with security risks, the reports of risk information can be generated, which can be submitted to the security department for processing to ensure the safe operation of assets on the nodes.

Node Invasion Detection

Support real-time monitoring of node invasion events, including host rebound Shell, high-risk system calls, etc.

Node Scanning

Allow you to set scanning cycle. Scan the software package on the node for vulnerabilities on time and provide repair suggestions.

Customized Enabling/Disabling of Node Protection

Allow you to customize the enabling/disabling of the node protection. After the protection is disabled, all assets on the current node will no longer be protected.

Container Security Guard

Features