KSPM graph

The KSPM Graph provides a functional map of your infrastructure, moving away from static lists to an interactive visual interface. This allows for a direct drill-down workflow: navigate from global clusters down to specific workloads, nodes, and container images.

By mapping the actual visual map of your environment, the platform integrates security intelligence, such as vulnerabilities and misconfigurations, directly onto the relevant assets. This provides immediate context on how a specific security risk sits within your network.

Key capabilities:

• Risk prioritization: By presenting security posture as a hierarchical graph, security teams can easily identify which clusters, namespaces, and workloads carry the highest aggregated risk. Cortex then prioritizes aggregated risk based on all the findings, vulnerabilities, and internet exposure.
• Granular filtering: Apply client-side filtering with AND/OR logic to isolate specific resources that you want to focus on. namespaces, clusters, or labels. You can filter dimensions that include cloud provider, cluster name, cloud account, severity levels, and specific finding types. Filters persist seamlessly across your drill-down navigation.
• Managing limited visibility: A yellow status indicator on a cluster signifies limited visibility. This state occurs when the cluster connector is either non-functional or non-existent, typically due to a missing or incorrectly configured Kubernetes Posture Management (KSPM) connector. Without an active connector, the system cannot facilitate necessary data transmission.

  In the Asset card, from the More Options menu, you can select to Deploy Connector.
• Instant insights: The popovers on any node instantly display a detailed security breakdown. From there, navigate to the full asset detail view for investigation.

Evaluate your security posture

KSPM Graph organizes your Kubernetes infrastructure into three navigable levels, each providing progressively deeper visibility. Access is integrated directly from the Kubernetes Assets.

Level	Description
Cluster level	Displays all Kubernetes clusters across cloud providers in a grid layout. Each cluster node shows aggregated security metadata, including the total count of vulnerabilities, issues, malware findings, secrets, and internet-facing assets.
Namespace level	When you expand a cluster, the graph shows the namespaces and VM instances. To identify risk levels and compliance status, drill down into individual namespaces and workloads for detailed risk assessment and compliance information.
Workload and container image level	When you expand a namespace, the graph shows individual workloads, such as deployments and jobs, and runtime container images. This view shows security findings, vulnerability severity histograms, risk scores, and internet exposure status to help you investigate them directly.