Runtime defense for containers
Runtime defense is the set of features that provide both predictive and threat-based active protection for running containers.
For example, predictive protection includes capabilities like determining when a container runs a process not included in the origin image or creates an unexpected network socket.
Threat-based protection includes capabilities like detecting when malware is added to a container or when a container connects to a botnet.
Prisma Cloud Compute has distinct sensors for file system, network, and process activity.
Each sensor is implemented individually, with its own set of rules and alerting.
The runtime defense architecture is unified to both simplify the administrator experience and to show more detail about what Prisma Cloud automatically learns from each image.
Runtime defense has two principle object types: models and rules.
Container Models
Models are the results of the autonomous learning that Prisma Cloud performs every time we see a new image in an environment.
A model is the ‘allow list’ for what a given container image should be doing, across all runtime sensors.
Models are automatically created and maintained by Prisma Cloud and provide an easy way for administrators to view and understand what Prisma Cloud has learned about their images.
For example, a model for an Apache image would detail the specific processes that should run within containers derived from the image and what network sockets should be exposed.
Navigate to
Monitor > Runtime > Container Models
.
Click on the image to view the model.There is a 1:1 relationship between models and images; every image has a model and every model applies to a single unique image.
For each image, a unique model is created and mapped to the image digest.
So, even if there are multiple images with the same tags, Prisma Cloud will create unique models for each image.
Models are built from both static analysis (such as building a hashed process map based on parsing an init script in a Dockerfile ENTRYPOINT) and dynamic behavioral analysis (such as observing actual process activity during early runtime of the container).
Models can be in one of 3 modes: Active, Archived, or Learning.
For containers in Kubernetes clusters, Prisma Cloud considers the image, namespace, cluster, and deployment (YAML) file when creating models.
- When the same image runs in multiple different clusters, Prisma Cloud creates separate models for each image in each cluster.
- When the same image runs in multiple different namespaces, Prisma Cloud creates separate models for each image in each namespace.
- When there are multiple running instances of an image in the same namespace, Prisma Cloud creates a single model.
- When there are multiple running instances of an image in the same namespace, but started from different deployment (YAML) files, Prisma Cloud creates multiple container models, one for each deployment.
Prisma Cloud shows you how models map to specific images.
Go to
Monitor > Runtime > Container Models
, click a model in the table, and click the General
tab.
Capabilities
Some containers are difficult to model.
For example, Jenkins containers dynamically build and run numerous processes, and the profile of those processes changes depending on what’s being built.
Constructing accurate models to monitor processeses in containers that build, run, test, and deploy software is impractical, although other aspects of the model can still have utility.
Prisma Cloud automatically detects known containers, and overrides one more aspects of the model with capabilities.
Capabilities are discrete enhancements to the model that tune runtime behaviors for specific apps and configurations.
Rather than changing what’s learned in the model, they modify how Prisma Cloud acts on observed behaviors.
For example, the following model for the Jenkins container is enhanced with the capability for writing and executing binaries.
Learning mode
Learning mode is the phase in which Prisma Cloud performs either static or dynamic analysis.
Because the model depends on behavioral inputs, images stay in learning mode for 1 hour to complete the model.
After this 1 hour, Prisma Cloud enters a 'dry run' period for 24 hours to ensure there are no behavioral changes and the model is complete.
If during this 24 hours period, behavioral changes are observed, the model goes back to Learning mode for additional 24 hours.
The behavioral model uses a combination of machine learning techniques and typically requires less than 1 hour of cumulative observation time for a given image (it might comprise of a single container running the entire learning period or multiple containers running for some time slice where the sum of the slices is 1 hour).
During this period, only threat based runtime events (malicious files or connections to high risk IPs) are logged.
Prisma Cloud automatically detects when new images are added anywhere in the environment and automatically puts them in learning mode.
