DO430 – Securing Kubernetes Clusters with Red Hat Advanced Cluster Security — Lesson 3: Runtime Detection, Process Activity, Network Graphs, Baselines, and Alerts

Learning Objectives

• Evaluate integration, security, resilience, performance, and exceptions affecting runtime detection, process activity, and network graphs.
• Apply behavioral baselines and alerts while preserving reviewable technical evidence.
• Recognize and correct the condition where the implementation succeeds normally but fails during dependency loss, scale, policy enforcement, or recovery.

Detailed Topics

• runtime detection: apply the concept to the course scenario, identify dependencies and controls, and record objective evidence of the result.
• process activity: apply the concept to the course scenario, identify dependencies and controls, and record objective evidence of the result.
• network graphs: apply the concept to the course scenario, identify dependencies and controls, and record objective evidence of the result.
• behavioral baselines: apply the concept to the course scenario, identify dependencies and controls, and record objective evidence of the result.
• alerts: apply the concept to the course scenario, identify dependencies and controls, and record objective evidence of the result.

Instructor Demonstration

The instructor demonstrates runtime detection, process activity, network graphs, baselines, and alerts by tracing architecture, commands, configuration, system messages, and evidence. The walkthrough tests how the implementation succeeds normally but fails during dependency loss, scale, policy enforcement, or recovery and explains how to isolate the cause without masking related issues.

Hands-On Exercise

Introduce a realistic boundary condition and test corrective behavior for Runtime Detection, Process Activity, Network Graphs, Baselines, and Alerts and add the verified result to the RHACS deployment baseline, security policy set, vulnerability evidence, runtime alerts, and response playbook.

1. Confirm scope, versions, access, dependencies, assumptions, and acceptance criteria.
2. Perform the workflow while recording commands, configuration, output, events, and decisions.
3. Test the normal path and one course-specific exception or boundary condition.
4. Retest the correction and document rollback, ownership, and follow-up actions.

Scenario Analysis

• Identify which dependency most strongly influences runtime detection in the stated scenario.
• Compare two approaches for behavioral baselines and explain the security, reliability, performance, and support trade-offs.
• Decide what evidence must be retained in the RHACS deployment baseline, security policy set, vulnerability evidence, runtime alerts, and response playbook before operational acceptance.

Troubleshooting Guidance

Begin with the first observable difference from the expected result. Check integration, security, boundary conditions, resilience, and performance separately, then correlate logs, events, commands, metrics, and configuration history. Treat the assumption that the implementation succeeds normally but fails during dependency loss, scale, policy enforcement, or recovery as a hypothesis until a reproducible retest confirms the cause.

Validation Checklist

• The required integration, security, boundary conditions, resilience, and performance were checked and recorded.
• The normal path and a course-specific exception were tested.
• The RHACS deployment baseline, security policy set, vulnerability evidence, runtime alerts, and response playbook links conclusions to commands, configuration, logs, metrics, or other objective evidence.
• Corrective actions, rollback, ownership, and handover notes are complete.

Lesson Outcome

Learners can apply Runtime Detection, Process Activity, Network Graphs, Baselines, and Alerts, explain the observed platform behavior, and support the result with a reviewable RHACS deployment baseline, security policy set, vulnerability evidence, runtime alerts, and response playbook.