SUSE Container Security Platform

Scans container image layers for OS package CVEs and application dependency vulnerabilities at build time, registry push, or pre-deployment, before execution.

Captures a continuous record of workload events (process, network, file, syscall) for forensic investigation of incidents in running workloads.

Enforces pod security standards, network policies, and RBAC controls across Kubernetes clusters, blocking non-compliant workload deployments and detecting policy drift.

Detects in-memory exploitation techniques (shellcode injection, heap spraying, ROP chains), in running workloads without relying on file-based signatures.

Monitors process execution, network connections, and file system activity in running workloads using a kernel agent, eBPF sensor, or sidecar container to detect behavioral anomalies and known attack patterns.

Enforces segmentation via a host agent at the OS network stack or through upstream network controls (cloud security groups, SDN, switch ACLs) where agents are not viable.

Discovers actual application communication flows by observing traffic before policy creation, producing a dependency map that forms the basis for allow-list policy without manual documentation.

Evaluates proposed segmentation policies against observed traffic to identify what legitimate connections would be blocked, enabling policy validation without a production enforcement change.

Applies consistent microsegmentation policy to cloud VMs and containers alongside on-premises workloads, using cloud-native enforcement mechanisms (security groups, NSGs) under unified policy.

Enforces identity-based allow policies (user identity, workload identity, device posture), rather than IP-based rules, policy follows the workload regardless of network location.

Blocks SMB, RDP, and WMI connections between endpoints by default, preventing ransomware from moving laterally via common network shares and remote management protocols.