> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/kubernetes-security/kubernetes-security.md). # Kubernetes Security The Kubernetes Security Posture Management (KSPM) capability, driven by the Kubernetes Connector component, is positioned as a core security module within Cortex Cloud. KSPM is a lightweight cloud-native solution for Kubernetes security, both posture management and real-time protection that automatically discovers assets, enforces policies, and scans for vulnerabilities, malware, secrets, and misconfigurations across the environment. The Cortex Cloud KSPM offering focuses on deep security posture and compliance checks: * Inventory and visibility: KSPM provides full visibility into your Kubernetes cluster and resources, including namespaces, nodes, and workloads. The KSPM dashboard provides a visual overview including inventory insights and cluster protection coverage to show which cluster have no protection solution deployed. * Compliance and misconfiguration detection: KSPM leverages hundreds of out-of-the-box KSPM rules. It detects compliance violations and misconfigurations using built-in and custom rules mapped to compliance controls. Compliance checks include CIS Benchmarks for both managed and unmanaged Kubernetes distributions. Custom rules are supported using Rego for the Kubernetes Connector, and Python for XDR Agent endpoints. * Vulnerability, malware, and secret scanning: KSPM receives critical security information related to vulnerabilities, malware, secrets, and other available scanners. The KSPM dashboard includes metrics for malware detected and secrets detected in clusters * Policy enforcement and control: By enabling an admission controller, you can ensure that all resources created within the cluster adhere to the desired security and governance standards, enhancing the overall security posture of your environment. The admission controller intercepts requests to the Kubernetes API server before they are persisted, allowing enforcement of access control, [image assurance](/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/types-of-cloud-workload-policies/trusted-image-cloud-workload-policies.md), and security configurations. * Centralized policy management: The offering provides centralized [Cloud Workload Policy management](/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/manage-cloud-workload-policies.md) and enforcement at runtime when the admission controller is utilized. * Real-time threat detection and response (XDR): Beyond static posture, the solution provides active XDR capabilities to detect and intercept threats as they happen. It monitors live cluster activity to identify malicious behavior, zero-day attacks, and unauthorized runtime changes. This ensures that instead of just finding vulnerabilities, you are actively defending your environment against ongoing attacks with immediate visibility and automated response. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/kubernetes-security/kubernetes-security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.