Cluster auditing¶
Securing a cluster environment requires visibility that extends far beyond the application layer. Cluster auditing defines a comprehensive strategy for capturing, preserving, and analyzing security telemetry across the entire infrastructure stack.
This document outlines the host-layer observability approach that enables deep inspection of the underlying nodes to capture system calls, privileged access, and process execution. Using this approach, organizations can establish an auditable trail of activity that is essential for meeting compliance mandates, enabling rapid incident response, and ensuring end-to-end accountability.