Funded research initiative

Kubernetes Storm Center.

An adaptive eBPF detection stack for Kubernetes. We combine mature open-source projects into a tunable signal-to-noise SOC, with node-local, real-time detection and a sovereign architecture.

optimize data-volume
tunable S/N
real-time detection

GitHub org Talk to us

What it is

An adaptive detection stack.

To detect attack paths, you need sensors and interpretation: The Kubernetes StormCenter is a research program that fuses several mature open-source eBPF projects into a single, tunable detection plane: protocol capture from Pixie, runtime anomaly detection from Kubescape, and Signal to Noise tuning via the Software Bill of Behavior tuner: `bobctl`.

Each component is upstream-maintained; and we work closely with the maintainers.

Components

github.com/k8sstormcenter — the SOC deployment
github.com/pixie-io — eBPF observability plane
github.com/kubescape — runtime anomaly detection
bobctl — Bill-of-Behavior generator

Getting Started

See the full evidence pre-correlation

With the new UI, you can now visualize the full evidence collected by the SOC. To try it out, you can deploy the SOC via skaffold on a kubernetes.

Three-stage animation — a redis SBOB (allowed behaviour: PING, GET, SET, EXPIRE) is broken by a CVE-2022-0543 Lua sandbox escape (whoami, /etc/shadow read, C2 lookup, fileless exec); Kubescape rules fire (R0001, R1005, R0006, R0010, R0002); DX sees the violation and issues OrderExportAll; the Adaptive-Write captures the full evidence set. — SBOB contrast → full evidence capture (redis, CVE-2022-0543 Lua sandbox escape): a single behavioural violation against the signed SBOB makes DX steer the Adaptive-Write to collect the *complete* evidence set — every specimen of the incident, not just the trigger.