<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-cloud-workload-protection
description: >-
  Deploy Cloud Workload Protection Platforms (CWPP) across Kubernetes nodes,
  VMs, and serverless workloads using Falco, Tetragon, Aqua, and cloud-native
  tools for runtime visibility, vulnerability management, and compliance.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - cwpp
  - falco
  - tetragon
  - runtime-protection
  - vulnerability-management
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1610"]
---

# Implementing Cloud Workload Protection

## Overview

CWPP provides runtime protection, vulnerability management, and compliance
monitoring for cloud workloads. This skill covers deploying Falco and Tetragon
for Kubernetes, leveraging cloud-native services (GuardDuty, Security Command
Center), and integrating with Trivy for continuous vulnerability scanning.

Mode: `[MODE: BLUE]` — Workload runtime protection. `[MODE: ARCHITECT]` — CWPP architecture design.

## Prerequisites

| Requirement | Details |
|---|---|
| Kubernetes cluster with Helm installed | Required |
| Falco >= 0.37 or Tetragon >= 1.0 | Required |
| Trivy >= 0.50 for K8s scanning | Required |
| AWS GuardDuty / GCP SCC enabled (optional) | Required |

## Key Concepts

### Deploy Falco for Runtime Detection

```bash
# Install Falco via Helm
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco \
  --namespace falco --create-namespace \
  --set falcosidekick.enabled=true \
  --set falcosidekick.config.slack.webhookurl="https://hooks.slack.com/XXX"

# Verify Falco is running
kubectl get pods -n falco
kubectl logs -n falco -l app.kubernetes.io/name=falco --tail=50
```

### Deploy Tetragon for eBPF Observability

```bash
# Install Tetragon
helm repo add cilium https://helm.cilium.io
helm install tetragon cilium/tetragon -n kube-system

# Define tracing policy for file access
cat <<YAML | kubectl apply -f -
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: monitor-sensitive-files
spec:
  kprobes:
  - call: "security_file_open"
    syscall: false
    args:
    - index: 0
      type: "file"
    selectors:
    - matchArgs:
      - index: 0
        operator: "Prefix"
        values:
        - "/etc/shadow"
        - "/etc/passwd"
        - "/run/secrets"
YAML
```

### Kubernetes Cluster Scan

```bash
# Trivy K8s cluster scan
trivy k8s --report summary cluster

# Scan specific namespace
trivy k8s --report all --namespace production

# Export to JSON
trivy k8s --format json --output cluster-scan.json cluster
```

### AWS GuardDuty Integration

```bash
# Enable GuardDuty
aws guardduty create-detector --enable --finding-publishing-frequency FIFTEEN_MINUTES

# Enable EKS protection
aws guardduty update-detector --detector-id DETECTOR_ID \
  --features '[{"Name":"EKS_AUDIT_LOGS","Status":"ENABLED"},{"Name":"EKS_RUNTIME_MONITORING","Status":"ENABLED"}]'

# List findings
aws guardduty list-findings --detector-id DETECTOR_ID --output json
```

## Workflow

```bash
node scripts/agent.js --action audit --namespace production --output /tmp/cwpp-audit.json
```

## Detection

```yaml
title: Cloud Workload Protection Detection
id: 2bd69d34-677f-47ea-b1db-db6a4ed6b3f8
status: experimental
description: Detects suspicious activity related to implementing cloud workload protection techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1610
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cloud Workload Protection Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1610 |

## Verification

- [ ] Falco or Tetragon deployed on all nodes
- [ ] Runtime alerts configured for container escape, secret access, shell spawning
- [ ] Trivy cluster scan runs daily (zero CRITICAL unfixed)
- [ ] GuardDuty/SCC enabled with EKS/GKE protection
- [ ] Alert routing to SIEM/Slack/PagerDuty operational

## References

- [Falco Documentation](https://falco.org/docs/)
- [Tetragon Documentation](https://tetragon.io/docs/)
- [NIST SP 800-190 — Container Security](https://csrc.nist.gov/publications/detail/sp/800-190/final)
