> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/kubernetes-security/kspm-graph.md).

# KSPM graph

The KSPM Graph provides a functional map of your infrastructure, moving away from static lists to an interactive visual interface. This allows for a direct drill-down workflow: navigate from global clusters down to specific workloads, nodes, and container images.

By mapping the actual visual map of your environment, the platform integrates security intelligence, such as vulnerabilities and misconfigurations, directly onto the relevant assets. This provides immediate context on how a specific security risk sits within your network.

**Key capabilities**:

* **Risk prioritization**: By presenting security posture as a hierarchical graph, security teams can easily identify which clusters, namespaces, and workloads carry the highest aggregated risk. Cortex then prioritizes aggregated risk based on all the findings, vulnerabilities, and internet exposure.
* **Granular filtering**: Apply client-side filtering with AND/OR logic to isolate specific resources that you want to focus on. namespaces, clusters, or labels. You can filter dimensions that include cloud provider, cluster name, cloud account, severity levels, and specific finding types. Filters persist seamlessly across your drill-down navigation.
* **Managing limited visibility**: A yellow status indicator on a cluster signifies limited visibility. This state occurs when the cluster connector is either non-functional or non-existent, typically due to a missing or incorrectly configured Kubernetes Posture Management (KSPM) connector. Without an active connector, the system cannot facilitate necessary data transmission.

  In the Asset card, from the More Options menu, you can select to Deploy Connector.
* **Instant insights**: The popovers on any node instantly display a detailed security breakdown. From there, navigate to the full asset detail view for investigation.

#### Evaluate your security posture <a href="#uuid-9c1c2d32-61df-f3de-b399-985980f0ebcc_bridgehead-id235388654629787" id="uuid-9c1c2d32-61df-f3de-b399-985980f0ebcc_bridgehead-id235388654629787"></a>

KSPM Graph organizes your Kubernetes infrastructure into three navigable levels, each providing progressively deeper visibility. Access is integrated directly from the Kubernetes Assets.

| Level                              | Description                                                                                                                                                                                                                                                                           |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Cluster level                      | Displays all Kubernetes clusters across cloud providers in a grid layout. Each cluster node shows aggregated security metadata, including the total count of vulnerabilities, issues, malware findings, secrets, and internet-facing assets.                                          |
| Namespace level                    | When you expand a cluster, the graph shows the namespaces and VM instances. To identify risk levels and compliance status, drill down into individual namespaces and workloads for detailed risk assessment and compliance information.                                               |
| Workload and container image level | When you expand a namespace, the graph shows individual workloads, such as deployments and jobs, and runtime container images. This view shows security findings, vulnerability severity histograms, risk scores, and internet exposure status to help you investigate them directly. |

<br>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/kubernetes-security/kspm-graph.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.