Runtime Events

Runtime Events helps you monitor and investigate runtime activity across your cloud environments in real time. Instead of relying only on scheduled security scans, Runtime Events continuously displays runtime events detected by the OX Runtime Sensor, allowing you to begin investigating suspicious activity as soon as it occurs.

From a single interface, you can:

• Monitor runtime activity as new events are detected.

• Investigate runtime events across your cloud and Kubernetes environments.

• Identify the assets generating the highest number of runtime events.

• Detect unusual spikes in runtime activity over time.

• Filter events by runtime attributes such as cloud account, Kubernetes resources, processes, containers, images, and MITRE ATT&CK tactics and techniques.

• Search for specific runtime events.

• Correlate events using the MITRE ATT&CK framework.

• Drill down into detailed event information to understand what happened and determine the scope of an incident.

To view Runtime Events:

• In OX, select Cloud > Runtime Events.

The Runtime Events page displays the runtime events detected during the selected time period.

Before you begin

Prerequisite: Runtime Events requires the OX Runtime Sensor to be installed and collecting runtime telemetry.

Runtime Events dashboard

The dashboard summarizes the runtime events detected during the selected time period.

Section	Description
Time range	Select the time period to investigate.
Search	Search the displayed runtime events.
Top Affected Assets	Displays the assets with the highest number of runtime events detected during the selected time period.
Events Volume	Displays the number of runtime events detected over time, helping you identify unusual spikes in activity.
MITRE Tactic	Displays the distribution of runtime events by MITRE ATT&CK tactic.
Events Log	Lists the runtime events that match the current filters.
Columns	Select the columns displayed in the Events Log.

Events Log

The Events Log lists the runtime events that match the selected time range and filters.

By default, the table includes the following information.

Column	Description
Date	When the runtime event was detected.
Event	The detected runtime event.
Process	The process associated with the event.
Target	The network target or destination associated with the event, when applicable.
Container	The container in which the event occurred.
Environment	The cloud or Kubernetes environment where the event occurred.

Note: Additional columns may be available depending on your environment and the selected event type.

Filters

Use the filters to narrow the displayed runtime events.

Filter	Description
Category	Filter events by event category.
MITRE Tactic	Filter events by MITRE ATT&CK tactic.
MITRE Technique	Filter events by MITRE ATT&CK technique.
Event	Filter by the detected runtime event.
Process	Filter by the process involved in the event.
Parent Process	Filter by the parent process that initiated the process.
Cloud Account	Filter by cloud account.
Cloud Region	Filter by cloud region.
Kubernetes Cluster	Filter by Kubernetes cluster.
Kubernetes Namespace	Filter by Kubernetes namespace.
Kubernetes Node	Filter by Kubernetes node.
Pod	Filter by Kubernetes pod.
Container	Filter by container.
Image	Filter by container image.
Image Tag	Filter by container image tag.
Container ID	Filter by container ID.
File / Connection	Filter by the related file or network connection.

Tip: Combine multiple filters to focus on a specific cloud account, Kubernetes workload, process, or MITRE ATT&CK tactic during an investigation.