Workload and runtime security · Domain Intelligence Pack
Monitor live workload execution and connect process behavior to images, deployments, identities, network paths, and services.
Overview
What the Runtime DIP monitors, detects, explains, and makes possible.
The Runtime DIP keeps live workload and runtime security state, with source and time preserved.
Findings assessed for security exposure and service impact.
Review the relationships and supporting evidence behind a finding.
Domain actions Ollandi can propose, each checked against policy before it runs.
Example investigation
Follow an illustrative condition through the domain signals, assessment, proposed response, and verification.
A production workload begins an unfamiliar execution sequence.
Ollandi relates the process to image lineage, deployment, identity, network destination, and service dependency.
A bounded communication restriction or quarantine is validated against availability and authority.
Execution and service health are checked before the incident is closed.
Coverage
Evidence keeps its source and time. Ollandi relates it to other packs, service dependencies, policy, authority, and history.
Domain Intelligence Packs
Every pack feeds the same shared state, so evidence from one domain can support or challenge another.
Domain Intelligence Pack
Monitor cloud control planes, identities, resources, posture, and exposure as one changing security state.
Learn moreDomain Intelligence Pack
Monitor human and machine identity, sessions, credentials, privilege, and access behavior across infrastructure.
Learn moreDomain Intelligence Pack
Monitor communication paths, segmentation, service reach, and movement across cloud, campus, data center, and hybrid networks.
Learn moreDomain Intelligence Pack
Monitor endpoint processes, users, files, software changes, connections, and device health in wider infrastructure context.
Learn moreDomain Intelligence Pack
Monitor private infrastructure, directories, virtualization, storage, databases, configuration, and hybrid dependencies.
Learn moreDomain Intelligence Pack
Monitor ATM availability, dispensing, cash, hardware, communications, security events, vendors, and service obligations.
Learn moreFAQ
Process behavior is assessed alongside image lineage, deployment records, configuration, and workload identity. This helps distinguish expected release activity from drift or suspicious execution.
No. The evidence, workload criticality, service dependencies, and permitted action scope inform the response proposal. Isolation is not the default for every anomaly.
Select a workload incident with process telemetry and deployment history. Review the explanation and the likely effect of a communication restriction, quarantine, or rollback.
Get started
Review a workload incident alongside its image, deployment, process, and service context.
