FAQ
Answers to common questions about FPT CWPP (Cloud Workload Protection Platform) for L1 Support.
1. Runtime agent
| # | Question | Answer |
|---|---|---|
| 1.1 | What is the runtime agent and why install it? | The runtime agent is a lightweight DaemonSet deployed on every node of a cluster. It monitors system calls, network connections, and container activity to detect threats and generate findings. Without the agent, the cluster still appears in Inventory but produces no runtime findings. |
| 1.2 | What network access does the agent need? | The network requirement banner above the cluster table lists the required connectivity: the agent on each node needs outbound access to FPT Security Platform over the specified protocol, port, and IP range. Whitelist egress to exactly those values shown on the banner. |
| 1.3 | How do I install the agent for a cluster? | On a cluster with status No agent, click Install Agent, read the Terms & Agreement, tick "I have read and agree to the terms above." (the button stays locked until ticked), then click Request installation. The agent moves to Installing, and to Agents active once nodes enroll. |
| 1.4 | How do I uninstall the agent? | On a cluster with Agents active, click Uninstall Agent, type uninstall (lowercase, case-sensitive), then click Confirm. The agent moves to Uninstalling and stops scanning workloads. No action buttons appear while a cluster is Installing or Uninstalling. |
| 1.5 | What do the agent status badges mean? | No agent = not installed (action: Install Agent). Installing = installing (no action). Agents active · X/X = all nodes healthy (action: Uninstall Agent). Agents active · X/Y (amber) = some agents down (action: Uninstall Agent). Uninstalling = removing (no action). |
| 1.6 | The badge shows Agents active · X/Y — what should I do? | This is a partial state: the cluster is protected but some agent nodes are down (X active of Y total). Hover the warning icon to see "N agent(s) are down" and "Please contact FPT Support for assistance." Contact FPT Support to recover the down agents. |
| 1.7 | Installation or uninstallation failed — what next? | On install failure (badge No agent + red icon): "Last installation attempt failed. Please wait 15 minutes, then click Install Agent to try again." On uninstall failure (badge Agents active + red icon): the agent is still running — click Uninstall Agent to try again. |
2. K8s Asset Inventory
| # | Question | Answer |
|---|---|---|
| 2.1 | What does K8s Asset Details show, and does it depend on the agent? | It lists the resources in a cluster (Resource · Type · Namespace · Node) and supports filtering by Resource name, Type, and Node. The resource list comes from KSPM / asset inventory and is independent of the runtime agent — it displays whether the agent is on, installing, uninstalling, or off. |
| 2.2 | A new cluster shows no resources — why? | A newly connected cluster may not have KSPM data yet, so the table shows "No records found". The same message appears when search/filter criteria do not match. Wait for inventory data to sync, or review the filter. |
| 2.3 | What does — mean in the Namespace or Node column? | Namespace = — means the resource is cluster-scoped (not in any namespace), for example many CRDs and Nodes. Node = — means the resource is not bound to a specific node. This is normal display, not a data error. |
3. Runtime Findings
| # | Question | Answer |
|---|---|---|
| 3.1 | What is a finding and where does it come from? | A finding is a runtime security signal detected during monitoring. Each finding has a Source badge: K8s Runtime (from the agent on Kubernetes nodes), K8s Audit (from Kubernetes Audit logs), or VM Runtime (from the agent on a VM). In the current phase, real data comes from K8s Runtime; the others are shown as mock data to illustrate the badges. |
| 3.2 | What does "observe mode only" mean? | A fixed banner above the filter bar reads "Findings currently support observe mode only. No actions can be taken from this screen." The Findings screen is for observation and investigation only — you can view, filter, and open finding details, but cannot take remediation actions here. |
| 3.3 | What do the severity badges C / H / M / L mean? | They are abbreviated severity badges: C = Critical, H = High, M = Medium, L = Low, each color-coded by level. |
| 3.4 | How do I search and filter findings? | Search by finding name, entity, Event ID, or Finding ID. Severity: Critical / High / Medium / Low. Time: Last 1h / 24h / 3d / 7d, default Last 24h. MITRE: filter by technique. Conditions combine with AND; the list sorts by Time descending. Refresh reloads the latest findings, keeping filters and returning to page 1. |
| 3.5 | How does filtering by MITRE technique work? | The MITRE dropdown filters by prefix match: selecting a root technique ID includes its sub-techniques — for example T1059 matches T1059.001, T1059.004, and so on. MITRE IDs in the table are hyperlinks that open the referenced MITRE ATT&CK page in a new tab. |
4. Finding details
| # | Question | Answer |
|---|---|---|
| 4.1 | Where do I open a finding's details? | In the Findings table, click the finding name (the Finding column link) to open a detail drawer that slides in from the right. Clicking other cells does not open the drawer. The drawer has four sections: Details, Known benign causes, Security Graph Context, and Raw Event. |
| 4.2 | How is Detection rule different from the finding title? | Detection rule is the general rule name that triggered the finding (for example "Container escape attempt (namespace/root manipulation)"). Finding title is a specific instance of that rule (for example "Container escape attempt via chroot"). One rule can produce several findings. Empty fields show —. |
| 4.3 | What are "Known benign causes", "Security Graph Context", and "Raw Event" for? | Known benign causes lists common false-positive scenarios so you can judge whether a finding is truly dangerous (collapsed by default — click Expand; shown only when the rule has this content). Security Graph Context is coming soon (placeholder "Security Graph enrichment coming soon..."). Raw Event is the original event data as JSON (collapsed by default — click Expand JSON). |
5. Access
| # | Question | Answer |
|---|---|---|
| 5.1 | Who can install or uninstall the runtime agent? | Only the CWPP Admin role. The Install Agent and Uninstall Agent buttons are hidden for CWPP Member, who can still view the K8s Asset List, K8s Asset Details, and Runtime Findings. |
6. Common errors
| # | Symptom | Common cause | Resolution |
|---|---|---|---|
| 5.1 | "System is busy. Please try again later." | Temporary backend error while loading a list or detail | Retry after a few moments |
| 5.2 | "No records found" | No matching data (cluster / resource / finding), or search/filter does not match | Review the filter criteria; wait for inventory or findings to sync |
| 5.3 | "You don't have permissions to access" | No permission to access CWPP | Contact your organization administrator. Note: if you can open the page but do not see the Install/Uninstall Agent buttons, that is the Member role, not an access error |