Getting Started with Cluster Sensor

Qualys Cluster Sensor offers an efficient way to collect Kubernetes (K8s) Inventory data. The K8s Inventory data within your cluster provides a more comprehensive understanding of the scanned area. This analysis can be used in many fields such as environmental monitoring, industrial automation, and smart infrastructure.

Qualys Cluster Sensor is useful from various perspectives, some of which are listed below.

Security: A Kubernetes inventory can identify and track all of an environment's Kubernetes resources. This information can be used to identify potential security vulnerabilities and implement security controls accordingly.
Troubleshooting: When issues arise, having an inventory of all resources and their configurations can greatly aid in troubleshooting and debugging. For example, Kubernetes inventory can be used to identify all of the Kubernetes resources that are running on a particular node. This information can then be used to identify the node that is causing a problem and to take corrective action.

For a new resource, Qualys Cluster Sensor collects and sends K8s inventory data every 2 minutes throughout the day and once at midnight (UTC) from the following resources.

Pod - Collects events such as creation, deletion, or edition of a POD.
Namespace - Collects events such as creation, deletion, or edition of a Namespace.

Supported Architecture

Qualys Cluster Sensor supports the following CPU architectures.

x86_64 (amd64)
aarch64 (arm64)

Cluster Sensor Workflow

Refer to the steps given below to understand the workflow of Qualys Cluster Sensor.

Pre-requisites

The below points ensure the working of the Qualys Cluster Sensor.

You need to have access to Qualys Cloud Platform along with the Container Security module enabled.
Qualys Cluster Sensor uses gateway URLs to communicate with Qualys Cloud Platform. If you are using proxy configuration, you must whitelist Qualys gateway URLs for the Cluster sensor to communicate with Qualys Cloud Platform.
Refer to API URLs section present on - https://www.qualys.com/platform-identification/