> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/kubernetes-security/kubernetes-security.md). # Kubernetes Security The Kubernetes Security Posture Management (KSPM) capability, driven by the Kubernetes Connector component, is positioned as a core security module within Cortex Cloud. KSPM is a lightweight cloud-native solution for Kubernetes security, both posture management and real-time protection that automatically discovers assets, enforces policies, and scans for vulnerabilities, malware, secrets, and misconfigurations across the environment. The Cortex Cloud KSPM offering focuses on deep security posture and compliance checks: * Inventory and visibility: KSPM provides full visibility into your Kubernetes cluster and resources, including namespaces, nodes, and workloads. The KSPM dashboard provides a visual overview including inventory insights and cluster protection coverage to show which cluster have no protection solution deployed. * Compliance and misconfiguration detection: KSPM leverages hundreds of out-of-the-box KSPM rules. It detects compliance violations and misconfigurations using built-in and custom rules mapped to compliance controls. Compliance checks include CIS Benchmarks for both managed and unmanaged Kubernetes distributions. Custom rules are supported using Rego for the Kubernetes Connector, and Python for XDR Agent endpoints. * Vulnerability, malware, and secret scanning: KSPM receives critical security information related to vulnerabilities, malware, secrets, and other available scanners. The KSPM dashboard includes metrics for malware detected and secrets detected in clusters * Policy enforcement and control: By enabling an admission controller, you can ensure that all resources created within the cluster adhere to the desired security and governance standards, enhancing the overall security posture of your environment. The admission controller intercepts requests to the Kubernetes API server before they are persisted, allowing enforcement of access control, [image assurance](/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/types-of-cloud-workload-policies/trusted-image-cloud-workload-policies.md), and security configurations. * Centralized policy management: The offering provides centralized [Cloud Workload Policy management](/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/manage-cloud-workload-policies.md) and enforcement at runtime when the admission controller is utilized. * Real-time threat detection and response (XDR): Beyond static posture, the solution provides active XDR capabilities to detect and intercept threats as they happen. It monitors live cluster activity to identify malicious behavior, zero-day attacks, and unauthorized runtime changes. This ensures that instead of just finding vulnerabilities, you are actively defending your environment against ongoing attacks with immediate visibility and automated response. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/kubernetes-security/kubernetes-security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.