Skip to main content

FPT CDR v1.0.0

I. Highlights​

FPT Smart Cloud introduces FPT CDR (Cloud Detection & Response) v1.0.0 — the first release of the cloud-native threat detection and response platform for cloud and Kubernetes environments.

This release delivers two core modules: Threats and Security Graph. The Threats module enables Tenant Admins to view threats correlated from runtime signals, CSPM, and KSPM detectors; inspect each threat's Attack Path, Factors Contributing, and MITRE ATT&CK mapping; close and re-open threats with comments; and collaborate via Comments with full Activity History.

The Security Graph module visualizes the complete topology of cloud and Kubernetes resources across 7 layers, enabling Tenant Admins to identify resources with Open threats (red border), investigate resource relationships via CONNECTIONS, and navigate seamlessly from Threat Detail to Security Graph to view nodes in real topology context.

II. Released Features​

1. Threat List​

a. Description​

Threat List provides comprehensive visibility into all threats active in the tenant: view, search, filter, sort, and perform bulk Change Status (Close / Re-open).

b. Feature​

  • Sidebar menu item Threats — entry point to the Threat List screen
  • Threat table with 6 columns: Type · Threat · Resource · Status · MITRE · Detected At — default sort by Detected At DESC (newest first)
  • Type badge: Proven in runtime (red) / Theoretical (blue)
  • Status badge: Open (blue) / Closed (gray)
  • Threat column: title as TextLink → navigates to Threat Detail on click; INV ID + finding count on line 2
  • Resource column: primary resource name + type badge; multiple resources → first + "+N"
  • MITRE column: first technique ID; multiple techniques → first + "+N" (e.g., T1071 +2)
  • Filter bar: Search (≥3 chars, real-time, case-insensitive) · Type (single select) · Status (single select) — all filters combine AND
  • Refresh button — reloads latest data; preserves filter and sort
  • Change Status (bulk action): checkbox per row; Select all = current page; dropdown Close / Re-open; modal with optional Comment (max 2,000 chars); Save (N) — N = threats actually changed; partial success and all-fail toasts
  • Pagination: default 10 rows/page; options 10/25/50/100; counter "X–Y of Z"; filter/search/page-size change resets to page 1

c. Capacity​

  • Threat list displayed with pagination (10/25/50/100 rows/page)
  • Bulk Change Status: no limit on batch size (bounded by current page selection)

2. Threat Detail​

a. Description​

Threat Detail provides full investigation context for a specific threat: Info Card (metadata), Attack Path (visual attack flow graph), Factors Contributing (issues/findings list), Comments (collaborative notes), and History (activity timeline). Tenant Admins can change threat status directly from this screen.

b. Feature​

  • ← Back button → returns to Threat List; restores filter, sort, and page
  • Header: Threat Title (H1) · INV ID badge · Status badge · Change Status button
  • Info Card: Threat ID · Type badge · Detected At · MITRE techniques (hover → full name tooltip; click → MITRE ATT&CK new tab) · Kill chain (shows "—" when unavailable)
  • Attack Path: visual graph; node role badges: "Entry point" (red solid) and "Target" (dark red solid); arrow + edge label (e.g., "Runs", "Grants role"); controls: Zoom out/in · Reset layout · Full screen · Legend (4 symbols); click node → popup with "View in Graph →" button → navigates to Security Graph with node highlighted
  • Factors Contributing: 5-column table (Id · Source · Finding/issue · Asset · Detected at); Source badges: CSPM Issue (orange) · KSPM Issue (blue) · K8s Runtime (purple); pagination 10/25/50/100
  • Tab Comments: chronological ascending list; avatar + author + timestamp + content; textarea (max 2,000 chars); Add comment button
  • Tab History: Activity Log timeline ascending; datetime · event · actor; first entry always "Threat detected · System"
  • Change Status (single): Close or Re-open with optional comment; Save (1) always enabled

c. Capacity​

  • Comments and History: no pagination (full list displayed)
  • Factors Contributing: paginated (10/25/50/100 rows/page)

3. Security Graph​

a. Description​

Security Graph visualizes the topology of all cloud and Kubernetes resources across 7 layers, enabling Tenant Admins to identify resources with Open threats, investigate resource relationships, and navigate to Threat Detail for remediation.

b. Feature​

  • Sidebar menu item Graph (under EXPLORE)
  • Graph canvas: 7-layer layout — EXTERNAL · ORGANIZATION · NETWORK · COMPUTE · K8S · IDENTITY · DATA; empty layer hidden; max 32 nodes/row per layer
  • Node border: red (≥1 Open linked threat) · blue (selected, highest priority) · gray (normal)
  • Controls: Zoom out/in · Reset layout · Full screen · Mini Map (bottom right, click/drag to pan) · Legend (bottom left, 5 symbols)
  • Filter bar: Search by resource name (≥3 chars → autocomplete max 25 nodes; select → canvas pan/zoom to node) · VPC (single select) · Cluster (single select); all combine AND; no match → "No records found"
  • Node Detail panel: click node → fields: Name · Type · VPC · Cluster · Namespace; LINKED THREATS [N] (Open threats only, DESC by Detected At, click → Threat Detail); CONNECTIONS [N] (format: [number] · [relationship] · [→/←] · [node name] · ([type])); click same node or × → panel closes
  • Navigate from Threat Detail: "View in Graph →" from Attack Path node popup → Security Graph opens; node highlighted (blue border); Node Detail panel auto-opened

c. Capacity​

  • Graph topology: all tenant resources (no canvas pagination)
  • Search autocomplete: max 25 nodes
  • LINKED THREATS: all Open threats, no limit
  • CONNECTIONS: all direct connections, no limit

III. Bug Fixes & Improvements​

#DescriptionType
1FPT CDR v1.0.0 — initial releaseN/A

IV. Version Information​

InfoDetails
Versionv1.0.0
Release date09/2026
Previous version— (first release)
New featuresThreats (Threat List, Threat Detail) · Security Graph
Target audienceTenant Admin
Breaking changesNone