Skip to main content

Security Hub v1.2.2

I. Highlights​

FPT Smart Cloud introduces Security Hub v1.2.2 as part of the FPT Security Platform (FSP), adding a new module — CWPP (Cloud Workload Protection Platform) — for Kubernetes runtime monitoring.

This release lets Tenant Admins manage the runtime agent on each Kubernetes cluster (install and uninstall), view the K8s Asset Inventory (all workload resources inside each cluster), and monitor Runtime Findings — security signals detected by a kernel-level agent and classified by MITRE ATT&CK. Each finding can be inspected in the Finding Detail Drawer with full context: infrastructure, process chain, threat classification, and raw event data.

note

Observe mode: Version v1.2.2 supports observe mode only. Findings are displayed for monitoring; direct response actions from the Findings screen will be added in a future release.

II. Released Features​

1. K8s Asset Inventory​

a. Description​

K8s Asset Inventory provides comprehensive visibility into all Kubernetes clusters in the tenant: runtime agent status per cluster, install/uninstall agent capability, and the full list of workload resources inside each cluster.

b. Features​

K8s Asset List (K8s Assets tab in Inventory):

  • New K8s Assets tab in the Asset Inventory screen — shows all clusters
  • Fixed Network Requirement Banner above the table — displays outbound protocol, port, and IP endpoints needed for the runtime agent; no dismiss button
  • Cluster table with 4 columns: Cluster · VPC · Agent · Actions — default sort: Cluster name A → Z
  • Real-time search by cluster name
  • Filter VPC (single select) and Filter Agent status (single select: Agents active / Installing / Uninstalling / No agent) — AND logic with Search
  • Agent badge — 5 states:
    • Agents active (full) — green · ShieldCheck · Agents active · X/X
    • Agents active (partial) — amber · AlertTriangle · Agents active · X/Y + warning icon (hover: down agent count + support guidance)
    • No agent — yellow · ShieldOff
    • Installing — blue spinner
    • Uninstalling — orange spinner
  • Error indicators: red icon appears when previous install/uninstall failed; retry available immediately

Install Agent flow:

  • Install Confirmation modal: description + scrollable Terms & Agreement + agreement checkbox
  • Request installation button: disabled until checkbox checked; enabled after
  • On confirm: modal closes, agent status No agent → Installing

Uninstall Agent flow:

  • Uninstall Confirmation modal: requires typing "uninstall" (lowercase, exact) in the text input
  • Confirm button: disabled until input matches exactly; enabled on match
  • On confirm: modal closes, agent status Agents active → Uninstalling

K8s Asset Details:

  • Click cluster name → navigate to K8s Asset Details screen
  • Header: cluster name + agent badge + VPC name
  • Resource list from KSPM / asset inventory — independent of agent state (shows even when agent is off, installing, or uninstalling)
  • 4 columns: Resource · Type · Namespace · Node — sort: Resource name A → Z
  • Real-time Search by resource name, Filter Type (single select), Filter Node (single select)
  • N resources counter updates in real time with filters
  • Back button: returns to K8s Asset List; list filters are preserved

c. Capacity​

  • Cluster and resource lists: per-tenant limits (no pagination in v1)
  • Agent state machine: No agent → Installing → Agents active → Uninstalling → No agent

2. Runtime Findings​

a. Description​

Runtime Findings consolidates all security signals detected by the K8s Runtime agent, classified by Severity and MITRE ATT&CK technique. Tenant Admins can search, filter, and inspect each finding in detail. Version v1.2.2 supports observe mode — no response actions.

b. Features​

Runtime Finding List (Findings menu):

  • New Findings menu item in the sidebar
  • Fixed Observe-mode Banner above the filter bar: "Findings currently support observe mode only. No actions can be taken from this screen." — no dismiss button
  • Refresh button: reloads latest findings; preserves filters and search
  • 8 columns: Severity · Time · Source · Finding · Entity · MITRE · Event ID · Finding ID — default sort: Time descending

Filter Bar (left to right: Search → Severity → Time → MITRE):

  • Search: finding name, entity, Event ID, Finding ID — real-time
  • Severity: Critical / High / Medium / Low
  • Time: Last 1h / Last 24h (default) / Last 3d / Last 7d — Last 24h applied on page load
  • MITRE: prefix match — selecting T1059 matches all T1059.x sub-techniques

Finding Detail Drawer:

  • Click finding name → drawer slides from the right; Finding List remains visible behind
  • Header: finding title + 3 badges (Source · Severity · MITRE link)
  • 4 sections: DETAILS · KNOWN BENIGN CAUSES · SECURITY GRAPH CONTEXT · RAW EVENT
  • Details: Time, Event ID, Finding ID, Detection rule, Cluster, Node, Namespace, Pod, Container, Image, Process, Command, Parent, Tactic, Technique, Context flags
  • Known Benign Causes: accordion, collapsed by default; hidden when no content defined
  • Security Graph Context: placeholder for upcoming feature
  • Raw Event: JSON toggle (Expand/Collapse), collapsed by default

c. Capacity​

  • Finding list: all findings in the selected time range (no pagination in v1)
  • Activity/history: not applicable — Runtime Findings are read-only in observe mode

III. Bug Fixes & Improvements​

#DescriptionType
1CWPP module initialized — no bug fixes from previous versionN/A