Cloud › Module 8 › Lesson 2
CWPP Named
CWPP literacy — Cloud Workload Protection runtime category, container/host alerts, drift — on `$CLOUD_LAB` workload stubs.
Visual · t31_cwpp_named
CWPP = named workload protection rows. $CLOUD_LAB. Original Cyberlium.
Opening
CSPM catches misconfigs — CWPP catches runtime behavior — name workload alert fields on YOUR lab container stubs.
Cloud Workload Protection Platform (CWPP) literacy names: runtime threat detection category, container/process anomaly alert, file integrity category, vulnerability on running workload vs image scan (Module 6-2 link), and agent/deployment hygiene category. Analyst maps two CWPP-style alerts on `$CLOUD_LAB` kind workload or instructor stub — documents triage (investigate, isolate lab pod category, false-positive tune category) — without deploying CWPP agent to stranger hosts, without using runtime alerts as excuse for escape PoC, without prod agent tampering without RoE. Cyberlium bridges CSPM posture to runtime — defender vocabulary on YOUR lab workloads. Refused: unauthorized prod agent disable, stranger host agent install, escape PoC triggered by 'alert testing.' Lab row: CWPP alert triage table two rows with link to Module 6 escape defenses.
1. Named CWPP alert fields
Alert type, workload ID, technique category, severity, recommended action — five literacy anchors.
Runtime alert differs from CSPM misconfig — document layer on triage row.
Command guide
Try these commands — Named CWPP alert fields
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, curl. Reference sites: CWPP (https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-workload-protection); AWS GuardDuty EKS (https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-eks-runtime-monitoring.html); Falco (https://falco.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Link to container module
Suspicious privileged spawn alert ties to Module 6-3 escape risk literacy.
Triage action = isolate lab pod in notes — not escape PoC validation.
3. Refused
No stranger host agent install; no prod agent tampering; no escape PoC for alert testing.
CWPP literacy supports runtime defense — not offensive trigger generation.
4. What you ship: CWPP alert triage table
Two alert rows + triage action + link escape defense + NEVER escape PoC line.
5. What you record before the next lesson
CWPP alert triage table path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Trigger container escape PoC on lab node to 'generate CWPP alert sample.'
Right
CWPP alert triage from `$CLOUD_LAB` workload stub. Next: IaC Scanning.
Mission: CWPP alert triage table
1) Name five CWPP alert fields. 2) Two triage rows on lab stub. 3) Link one alert to Module 6-3 defense. 4) Write NEVER escape PoC for alert line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “CSPM vs CWPP — one-line literacy?”
Knowledge Check
APPLY: CWPP literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Escape PoC for CWPP alert testing is lab.
True or False
Knowledge Check
APPLY: CWPP differs from CSPM:
Multiple choice