Investigate – Threat Detection & Response 

The Investigate Page in Container Security lists threat detections detected on running workloads. These can include detections such as cryptominers, privilege escalations, anomalous network activity and more detected in runtime through analysis of process, file, network, and DNS activity. Threat detections can be further investigated by incident response teams.  

For details on detection coverage, please contact Qualys Customer Support for more details. 

Key Pre-Requisites   

• Container Runtime (eBPF) Sensor. Please navigate to this document or to the Interoperability Matrix to see which environments are supported. 
• There is a specific allowlist that needs to be configured for the sensor to ensure activity is collected appropriately 
• A TotalCloud license. For any assistance, please contact Customer Support.  

Viewing Threat Detections 

Individual Threat Detections can be viewed by navigating to the Investigate Page. By default, detections over the last 30 days are shown and can be changed by using the dropdown on the top right.  

Detections can be grouped by Cluster, Category, Cloud, Resource and more. Each detection is individually mapped at a container level. Threat detections are also correlated with the MITRE ATT&CK Framework.  

Viewing Detection Details  

To view details of a threat detection, click the name of the detection. On the right, users can see  different information, such as:  

• Asset context 
• The detection details 
• Event metadata such as which process, process ID, parent process, file paths, network IPs, DNS names, and more 
• Command line arguments 
• MITRE ATT&ACK Tactics and Technique details 

You can also click the source event at the top to view the individual event (process, network, file, DNS) that led to the threat detection. Upon clicking the source event, security teams can view more details on the raw event. 

Group By Options 

Qualys Container Security provides a variety of Group By Options to make filtering and viewing simple at a holistic environment level.  

By Category of Detection Detected 

Upon clicking the Group By Category option, users can see the overall detections fired across all clusters and the count against each finding. This is a good way to get a holistic view on the overall types of threats detected in your environment.  

By Grouped Qualys Assets (QLPs) 

Many times, threat detections fired against individual containers can create a flood of alerts in your environments. The goal should be to see findings grouped at a sensible hierarchical level in your Kubernetes and container environments and then respond once to sustain continuous remediation.  

Qualys Locator Paths ensure containers and clusters are grouped at hierarchies that are sustainable for viewing multiple events together. Customers can group by Container QLP to see findings grouped at Kubernetes/container hierarchies. For example in the screenshot below, individual container ids are grouped by Kubernetes container QLPs (account/cluster/namespace/pod/container).  

Correlation With TruRisk™ Insights & Attack Paths 

Noteworthy runtime alerts are also surfaced up in certain toxic risk combinations (insights) and the attack path graph. Upon clicking the runtime alert node in the graph, users are navigated to the investigate page to view more details.  

Forwarding Events to a SIEM 

Events can be sent to any SIEM of your choice (for example Splunk, Azure Sentinel, Logstash, and so on).  

• Generic Webhook Integration (works on any SIEM): https://docs.qualys.com/en/integration/cdr-webhook/get_started/get_started.htm 
• Azure Sentinel Integration: https://docs.qualys.com/en/integration/cdr-azure-sentinel/get_started/overview.htm