Container Runtime Sensor Release 1.7.0

August 03, 2026

CRS 1.7.0 significantly expands runtime protection with new network-layer visibility and enforcement, file-integrity blocking using BPF LSM, DNS-based threat detection, and major efficiency improvements to process event handling. Together, these capabilities extend CRS from an audit-and-alert sensor toward active, policy-driven prevention at the kernel level, while reducing the event volume customers need to process.

DNS Flow Logging for Threat Detection

CRS now parses DNS responses inside containers and reports every domain name resolved by container workloads to the Qualys Enterprise TruRisk™ Platform. DNS traffic is intercepted for auditing only - CRS never blocks or interferes with DNS resolution.

Key Benefits

This feature offers the following benefits.

• A dedicated DNS event type for every resolved domain and forwards it to the Qualys Enterprise TruRisk™ Platform, giving security teams near-real-time visibility into container workload network behavior.

• Detection of domain generation algorithm (DGA) activity, command-and-control (C2) callbacks, and other suspicious DNS lookups at the container level - threat categories that perimeter DNS logs cannot attribute to individual workloads.

• Provides workload-attributed DNS telemetry, so security teams can identify exactly which container resolved a suspicious domain, eliminating the need to correlate node-level DNS logs against container activity separately.

Egress Filtering by IP or FQDN

Without explicit egress controls, a compromised container can freely connect to attacker-controlled infrastructure — traditional network controls operate at the node or cluster boundary, not the individual container. CRS now enforces container egress policy at the kernel level, blocking outbound connections to any destination not included in an administrator-defined allowlist of IPs, CIDR ranges, or fully qualified domain names (FQDNs). This brings zero-trust network enforcement directly to the container workload boundary.

Key Benefits

This feature offers the following benefits.

• Enforces a policy-driven allowlist of permitted outbound destinations (monitor-dest-ips / monitor-fqdns), giving security teams precise control over which external IPs, CIDRs, and FQDNs each container workload may reach.
• Blocks connections to non-allowlisted destinations at the kernel level and generates an audit event for every blocked attempt, providing both enforcement and a complete record of unauthorized outbound traffic for forensic investigation.
• Reduces the blast radius of a compromised container by preventing C2 communication and data exfiltration to unauthorized external infrastructure - without requiring changes to external firewalls or network ACLs.

Ingress Filtering by IP

Containers are reachable from any source IP unless inbound access is controlled at the workload level, exposing them to unauthorized access and east-west lateral movement that perimeter controls cannot block. 

Key Benefits

This feature offers the following benefits.

• CRS now enforces ingress policy at the kernel level, blocking inbound connection attempts from any source IP not included in an administrator-defined allowlist of IPs or CIDR ranges.
• Enables a policy-driven allowlist of permitted source IPs and CIDR ranges per container workload, restricting which callers are allowed to establish inbound connections to each service.
• Blocks inbound connection attempts from non-allowlisted source IPs and generates an audit event for every blocked attempt, supporting both real-time enforcement and post-incident forensic review.
• Enforces network segmentation at the container boundary, limiting the reach of any compromised workload attempting lateral movement to peer services within the cluster.

File Integrity Enforcement using BPF LSM

Kernel Requirement:
- BPF LSM enforcement requires a host kernel built with CONFIG_BPF_LSM=y and bpf listed in the kernel's lsm= boot parameter.
- Linux Kernel: 6.1.x or later

Detecting unauthorized file deletions and renames after the fact provides limited protection - an attacker who deletes logs, overwrites a binary, or moves a critical configuration file has already achieved their objective before any alert fires. CRS now uses BPF Linux Security Module (LSM) hooks to actively block unauthorized file deletions (unlink) and file renames or moves (rename) inside containers, enforcing file integrity policy at the kernel level before the operation completes. This extends CRS capabilities from audit-and-alert to active prevention for container file integrity events.

Key Benefits

This feature offers the following benefits.

• Prevents unauthorized file deletions and renames at the kernel level before the operation completes, protecting critical container files from destruction or tampering by a compromised or malicious process.
• Delivers kernel-level enforcement independent of the container runtime or user-space hooks, making the control highly resistant to bypass by a compromised container process that has gained elevated privileges.

New Policy Configuration using Qualys Runtime CRD

Managing runtime security policies outside the Kubernetes control plane creates operational overhead, policy drift. CRS now supports configuring runtime policies for Ingress filtering, Egress filtering, and BPF LSM file enforcement logging using the Qualys Runtime CRD. 

Key Benefits

This feature offers the following benefits.

• Allows security and platform teams to define, update, and version-control network and file enforcement policies as Kubernetes-native resources, consistent with how other CRS runtime policies are managed today.
• Reduces the operational overhead of managing policies across Ingress, Egress, and LSM event types.

Process Event Deduplication

In steady-state clusters, most process execution events are repetitions of known behavior. Forwarding every instance inflates storage costs, degrades query performance, and buries actionable signals in noise. CRS now deduplicates repeated process executions at the sensor before they are forwarded to the Qualys Enterprise TruRisk™ Platform, eliminating redundant data without sacrificing audit coverage. 

To support this feature, CRS has introduced processAllowList parameter CS Helm chart (runtime-sensor/values.yaml).
processAllowList
    enabled: false

Key Benefits

This feature offers the following benefits.

• Reduces process event volume in steady-state clusters, directly lowering storage costs and detection performance over high event streams.
• Provides a configurable allowlist that ensures high-priority processes - such as those required for compliance, auditing, or incident response - are reported subject to deduplication.

Process event deduplication is enabled by default.

Issues Addressed

The following issues have been fixed with this release.

Category	Issue
Egress Policy	CRS crashed while setting up the Egress Policy with exit status 2 and entered a continuous restart loop.