Skip to main content

FAQ

Answers to common questions about FPT CDR (Cloud Detection & Response) for L1 Support.

1. Threats​

#QuestionAnswer
1.1What is a threat and where does it come from?A threat is an active danger that the system correlates from several signal sources — runtime signals, CSPM and KSPM detectors — and enriches with the Security Graph (the Threats subtitle reads "Active threats correlated from runtime signals and enriched by Security Graph."). Unlike a single finding, a threat groups several related findings into one attack picture.
1.2What is the difference between Proven in runtime and Theoretical?The Type column shows how confirmed a threat is. Proven in runtime (red badge) is confirmed by real runtime signals — handle it first. Theoretical (blue badge) is based on theoretical analysis, not yet confirmed by runtime signals.
1.3What do Open and Closed mean?Open (blue badge) means the threat is open and not yet handled. Closed (gray badge) means a Tenant Admin closed it. A threat always starts Open and can move back and forth between Open and Closed.
1.4How do I close or re-open a threat?On the Threat List, tick one or more threats (the Change Status button enables; hovering while none are selected shows "Select threats first"). Click Change Status, choose Close or Re-open, optionally add a Comment, then click Save (N). A toast confirms "N threat(s) closed" or "N threat(s) re-opened", and the change is written to History. You can also change status from the Threat Detail header.
1.5What happens if I select both Open and Closed threats?The dropdown offers both Close and Re-open, but the system only applies the action to matching threats: Close affects only Open ones, Re-open affects only Closed ones. The N in the toast is the number actually changed. If everything fails, it shows "Failed to update threats. Please try again." and the list is unchanged until you Refresh.
1.6How do I search and filter threats?Search by threat name or INV ID (at least 3 characters). Type: Proven in runtime / Theoretical. Status: Open / Closed. Conditions combine with AND; the list sorts by Detected At descending (click the column header to reverse). Changing page or page size clears the current selection.
1.7What does INV-... · N finding(s) mean in the Threat column?Each threat has an INV ID (an investigation code such as INV-2026-0420) and the number of findings it groups, shown on the second line of the Threat column (for example "INV-2026-0420 · 3 findings"). Click the threat name on the first line to open Threat Detail.

2. Threat Detail​

#QuestionAnswer
2.1What does the Threat Detail screen show?An Info Card (Threat ID, Type, Detected At, clickable MITRE techniques, Kill chain), the Attack path graph, the Factors contributing to this threat table, and the Comments (default) and History tabs. The ← Back button returns to the Threat List with your previous filter, sort, and page preserved.
2.2How do I read the Attack path?The Attack path is a graph of the attack chain. Each node is an entity (for example IAM Role, S3 Bucket, Pod), linked by arrows labeled with the action (for example "Runs", "Grants role"). Node roles (see Legend): Entry point (source node), Attack step (intermediate, red border), and Target (destination). Use Zoom out / Zoom in / Reset layout / Full screen to navigate.
2.3What is "View in Graph" in the attack path for?Clicking a node in the attack path shows a popup with the node name, resource type, and a View in Graph → button. It switches to the Security Graph, locates and highlights that node with a blue border, and opens the Node Detail panel automatically so you can investigate surrounding connections.
2.4What is "Factors contributing to this threat"?A table of the findings/issues that formed the threat, with columns Id · Source · Finding/issue · Asset · Detected at. The Source column shows where it was detected: CSPM Issue (orange badge), KSPM Issue (blue badge), or K8s Runtime (purple badge). The table paginates (10 rows per page by default).
2.5What are Comments and History for?Comments record discussion about a threat — type a note and click Add comment (up to 2000 characters). History is the threat's activity log over time; each line has a timestamp, event, and actor, and the first line is always "Threat detected · System". Every status change (with its comment, if any) is recorded here.

3. Security Graph​

#QuestionAnswer
3.1What is the Security Graph and how is it organized?The Security Graph visualizes how cloud and Kubernetes resources connect so you can investigate relationships and risk (subtitle: "See how your resources connect and where the risks are."). Nodes are organized into 7 layers top to bottom: EXTERNAL · ORGANIZATION · NETWORK · COMPUTE · K8S · IDENTITY · DATA. Open it from the Graph menu, or from View in Graph → in Threat Detail.
3.2What do red, gray, and blue node borders mean?Red border: the node has at least one Open linked threat. Gray border: a normal node (no open threat). Blue border: the currently selected node (takes priority over red).
3.3What can I see when I click a node?Clicking a node opens the Node Detail panel (titled "Resource Details") on the right: resource info (Name, Type, VPC, Cluster, Namespace — — when absent), LINKED THREATS [N] (only Open threats, newest first; click one to open Threat Detail; "No records found" when N = 0), and CONNECTIONS [N] (direct connections with sequence number, relationship type, direction, and the related node). Click the node again or Close to dismiss.
3.4How do I search and filter nodes in the graph?Search ("Search by resource name") needs at least 3 characters; below that it shows "Type at least 3 characters to see matching resources". Autocomplete shows up to 25 matching nodes; selecting one pans/zooms to it. Select VPC and Select cluster filter the canvas. Conditions combine with AND; if nothing matches, the canvas shows "No records found". Refresh reloads the latest topology.
3.5Why are some layers not shown?A layer with no nodes (after load or after a filter) is hidden from the canvas, keeping the order of the remaining layers. When you clear the filter and the layer has nodes again, it reappears. This is normal behavior, not missing data.
3.6When I select a node, what do the numbers and arrow styles on the links mean?Normally links are unlabeled. In Node Selected mode, direct links show sequence numbers (1, 2, 3…) matching the CONNECTIONS panel. A solid arrow is outgoing (this node → other); a dashed arrow is incoming (other → this node). Unrelated nodes and links are dimmed. The specific relationship type (for example Grants role, Runs as) is shown in the CONNECTIONS panel, not on the link. A Mini Map and Legend are also available.

4. Access​

#QuestionAnswer
4.1Who can view and act on threats?CDR (Threats and Security Graph) shares permissions with CSPM and CWPP and works on their data. Any account with the Admin or Member role of CSPM/CWPP can view and act fully — Close/Re-open a threat, add a comment, and View in Graph. No action is restricted to Admin only.

5. Common errors​

#SymptomCommon causeResolution
5.1"System is busy. Please try again later."Temporary backend error (list, detail, graph, status change)Retry after a few moments
5.2"No records found"No matching data (threat, finding, comment, node), or search/filter does not matchReview the filter criteria
5.3"Failed to update threats. Please try again."Every threat in the status change failedClick Refresh, then try again
5.4"Some threats were already updated. Please refresh."Status changed (for example by someone else) before your action was sentClick Refresh to load the latest state
5.5"You don't have permissions to access"No permission for the module (requires the Admin or Member role of CSPM/CWPP)Contact your organization administrator