# Cloud runtime detection and response

Turn audit records into actionable incidents. Connect workload identity, response ownership, credential revocation and the recreating controller.

Original AI-assisted SecNet educational content. Fictional local examples; not a standards provider publication, endorsement or compliance evidence. Page exercises do not create account progress.

Sources checked: 2026-10-21

## What is and is not logged?

Log enabled is not incident visibility. Define required API actions, event level, time, identity and external destination. Request/response bodies may contain secrets or personal data; minimize captured content. Separate log-store authority from workload administration. Verify audit availability and retention in managed-service configuration, and do not interpret missing data as absence of incidents.

## Detection and workload attribution

Prepare fictional event cards for unexpected secret reads, privileged workloads or risky role bindings. Preserve Pod UID, namespace, service account, image digest and controller relationships alongside IPs. An alert is not a confirmed incident; check legitimate administrative changes during triage. Assign ownership, contact channel, timing objectives and a workable playbook. A red screen alone does not create response capability.

## Why deleting a Pod is insufficient

A Deployment controller can recreate the same problematic Pod. Preserve evidence where possible and use authorized response to constrain controller, workload identity and entry source together. Stopping a process does not revoke an exfiltrated token. Use an environment-specific approved playbook and service-impact assessment rather than an arbitrary live command list. This workshop deletes no Pods, changes no network rules and revokes no real credentials.

## Worked example: the recurring alert

The Harbor Pod restarts from the same image minutes after deletion and alerts again. podDeleted=true is not containment. The model separates evidence preservation, revocation, controller containment and root-cause review. An actual timeline should include first signal, identity changes, authorized actions and business validation. Update detection and relevant configuration tests afterward. Exercise outputs are neither real incident records nor automated security scores.

## Working sequence

1. Define events needed for detection.
2. Test audit coverage without secret bodies.
3. Bind alerts to workloads and owners.
4. Preserve evidence and constrain authority at its source.
5. Close root cause through regression and detection.

## 1. Logs enabled, evidence missing

logEnabled is insufficient without required events and a controlled external sink. Capturing secret-bearing bodies is not simply better visibility; it creates additional data risk.

This code is a local policy model; it does not replace target/cluster testing.

### Weak implementation
```js
s=>s.logEnabled
```

### Corrected implementation
```js
s=>s.logEnabled&&s.requiredEvents&&s.externalSink&&s.accessControlled&&!s.secretBodies
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "usable-audit",
      "input": {
        "logEnabled": true,
        "requiredEvents": true,
        "externalSink": true,
        "accessControlled": true,
        "secretBodies": false
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-events",
      "input": {
        "logEnabled": true,
        "requiredEvents": false,
        "externalSink": true,
        "accessControlled": true,
        "secretBodies": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "secret-request-body",
      "input": {
        "logEnabled": true,
        "requiredEvents": true,
        "externalSink": true,
        "accessControlled": true,
        "secretBodies": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "usable-audit",
      "input": {
        "logEnabled": true,
        "requiredEvents": true,
        "externalSink": true,
        "accessControlled": true,
        "secretBodies": false
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-events",
      "input": {
        "logEnabled": true,
        "requiredEvents": false,
        "externalSink": true,
        "accessControlled": true,
        "secretBodies": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "secret-request-body",
      "input": {
        "logEnabled": true,
        "requiredEvents": true,
        "externalSink": true,
        "accessControlled": true,
        "secretBodies": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 2. An unowned alert

Firing an alert does not assign response. Without workload attribution, an owner and a tested playbook, actionable handling has not been established.

This code is a local policy model; it does not replace target/cluster testing.

### Weak implementation
```js
s=>s.alertFired
```

### Corrected implementation
```js
s=>s.alertFired&&s.workloadAttributed&&s.ownerAssigned&&s.playbookTested
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "actionable",
      "input": {
        "alertFired": true,
        "workloadAttributed": true,
        "ownerAssigned": true,
        "playbookTested": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "no-owner",
      "input": {
        "alertFired": true,
        "workloadAttributed": true,
        "ownerAssigned": false,
        "playbookTested": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "unattributed",
      "input": {
        "alertFired": true,
        "workloadAttributed": false,
        "ownerAssigned": true,
        "playbookTested": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "actionable",
      "input": {
        "alertFired": true,
        "workloadAttributed": true,
        "ownerAssigned": true,
        "playbookTested": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "no-owner",
      "input": {
        "alertFired": true,
        "workloadAttributed": true,
        "ownerAssigned": false,
        "playbookTested": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "unattributed",
      "input": {
        "alertFired": true,
        "workloadAttributed": false,
        "ownerAssigned": true,
        "playbookTested": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 3. The deleted Pod returned

Deleting a Pod does not remove its controller source or leaked authority. Address evidence, revocation, controller boundaries and root cause together.

This code is a local policy model; it does not replace target/cluster testing.

### Weak implementation
```js
s=>s.podDeleted
```

### Corrected implementation
```js
s=>s.evidencePreserved&&s.credentialRevoked&&s.controllerContained&&s.rootCauseReviewed
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "contained-source",
      "input": {
        "podDeleted": true,
        "evidencePreserved": true,
        "credentialRevoked": true,
        "controllerContained": true,
        "rootCauseReviewed": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "controller-recreates",
      "input": {
        "podDeleted": true,
        "evidencePreserved": false,
        "credentialRevoked": false,
        "controllerContained": false,
        "rootCauseReviewed": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "credential-still-active",
      "input": {
        "podDeleted": true,
        "evidencePreserved": true,
        "credentialRevoked": false,
        "controllerContained": true,
        "rootCauseReviewed": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "contained-source",
      "input": {
        "podDeleted": true,
        "evidencePreserved": true,
        "credentialRevoked": true,
        "controllerContained": true,
        "rootCauseReviewed": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "controller-recreates",
      "input": {
        "podDeleted": true,
        "evidencePreserved": false,
        "credentialRevoked": false,
        "controllerContained": false,
        "rootCauseReviewed": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "credential-still-active",
      "input": {
        "podDeleted": true,
        "evidencePreserved": true,
        "credentialRevoked": false,
        "controllerContained": true,
        "rootCauseReviewed": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## Exit evidence

- Covered but data-minimized audit samples
- Incident timeline linked to workload/identity/controller

## References

- [Kubernetes · Auditing](https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/)
- [NIST SP 800-190 · Container security](https://csrc.nist.gov/pubs/sp/800/190/final)