Views:

Stop the spread of suspicious behavior within a container by isolating the containing pod from the environment.

This task is supported by the following services:
  • Trend Vision One Container Security
Important
Important
Only currently running Kubernetes pods are supported for the Isolate Container task.
The Isolate Container task allows you to limit the spread of suspicious processes within a container and investigate their causes by disconnecting the pod from relevant networks and preventing data transfer into and out of the pod. Isolating a container is preferable to terminating a container because it preserves the evidence needed to prevent the behavior from happening again. Start the task using context menus on the Trend Vision One console.

Procedure

  1. After identifying the container to isolate, access the context or response menu and click Isolate Container.
    The Isolate Container Task screen appears.
  2. Confirm the target of the response.
  3. Specify a Description for the response or event.
  4. Click Create.
    Trend Vision One creates the task and displays the current task status in Response Management.
  5. Monitor the task status.
    1. Go to Workflow and Automation → Response Management .
    2. (Optional) Locate the task using the Search field or by selecting Isolate Container from the Action drop-down list.
    3. View the task status.
      • In progress (in_progress=GUID-A55897DB-3DEA-4F5C-B7F9-70B3D7FB9EDE=1=en-us=Low.jpg): Trend Vision One sent the command and is waiting for a response.
      • Successful (successful=GUID-1E31AD86-DE2E-48B5-85F7-7C78A3E8BB11=1=en-us=Low.jpg): The command was successfully executed.
      • Unsuccessful (error=5cc21722-7ceb-480c-b9c2-a47d420cf1cc.jpg): An error or time-out occurred when attempting to send the command, or the specified pod no longer exists.
    After resolving the security issue in the isolated container, you can resume the container by clicking the options button (options_icon=GUID-408062FA-DA13-4ECA-81EB-31A5B68355A1=1=en-us=Low.jpg) associated with the Response Management task and selecting Resume Container.
    For more information, see the Resume Container task.