https://argonix.io/assets/CloudSecurity-D4bynI6p.js

1import{u as l,m as i,c as d,e as r,d as t,w as o,i as n,t as c,j as p,b as u,f as a}from"./index-6yz22RyK.js";import{g as x}from"./useHreflang-DSA4jYQj.js";import{_ as m}from"./NavHeader-BmB9sEL-.js";const b={class:"min-h-screen bg-cream text-neutral-800"},g={class:"mx-auto max-w-7xl px-6"},h={class:"pb-16 pt-8 text-center"},f={class:"mb-8 text-sm text-neutral-500","aria-label":"Breadcrumb"},y={class:"py-16"},v={class:"mb-10 flex flex-wrap justify-center gap-4 text-sm font-semibold text-pink-700"},w={class:"py-16"},S={class:"grid md:grid-cols-3 gap-6 max-w-4xl mx-auto"},k={class:"border-t border-neutral-200/60 bg-white/50 py-8 mt-12"},C={class:"mx-auto max-w-7xl px-6 text-center text-sm text-neutral-400"},M={__name:"CloudSecurity",setup(A){const{locale:P}=l();return i({title:"Cloud Security from Code to Runtime — CSPM, SAST, eBPF - Argonix",meta:[{name:"description",content:"Cloud security from code to runtime: CSPM, inventory, SAST/DAST, secrets, CVEs, SBOMs, and Tetragon-powered kernel/eBPF detection across AWS, Azure, GCP, and Kubernetes."},{name:"keywords",content:"CNAPP, CSPM, cloud security, DevSecOps, eBPF, Tetragon, SAST, DAST, Gitleaks, Trivy, cloud inventory, runtime security, attack paths"},{property:"og:title",content:"Security from Code to Runtime — Argonix"},{property:"og:description",content:"CSPM, AppSec, correlated inventory, and eBPF runtime detection with Argonix Sensor and Tetragon."},{property:"og:url",content:"https://argonix.io/en/cloud-security"},{property:"og:locale",content:"en_US"},{property:"og:type",content:"website"},{property:"og:image",content:"https://argonix.io/og/cloud-security-en.png"},{property:"og:image:width",content:"1200"},{property:"og:image:height",content:"630"},{name:"twitter:card",content:"summary_large_image"},{name:"twitter:image",content:"https://argonix.io/og/cloud-security-en.png"}],link:[{rel:"canonical",href:"https://argonix.io/en/cloud-security"},...x("cloud-security")]}),(I,e)=>{const s=p("router-link");return u(),d("div",b,[r(m),t("main",g,[t("section",h,[t("nav",f,[r(s,{to:"/en",class:"hover:text-pink-600"},{default:o(()=>[...e[0]||(e[0]=[a("Home",-1)])]),_:1}),e[1]||(e[1]=t("span",{class:"mx-2"},"›",-1)),e[2]||(e[2]=t("span",{class:"text-neutral-800 font-semibold"},"Cloud Security",-1))]),e[3]||(e[3]=n('<h1 class="text-4xl font-extrabold leading-tight tracking-tight md:text-6xl"><span class="bg-gradient-to-r from-red-500 via-rose-500 to-purple-600 bg-clip-text text-transparent">Security from Code to Runtime</span><br><span class="text-neutral-800">Posture, Vulnerabilities, Inventory &amp; eBPF</span></h1><p class="mx-auto mt-6 max-w-3xl text-lg text-neutral-600 leading-relaxed"> One DevSecOps platform for AWS, GCP, Azure, and Kubernetes: CSPM, SAST/DAST, secrets, CVEs, correlated inventory, and kernel/eBPF runtime detection through the Tetragon-powered Argonix Sensor. </p><div class="mt-10 flex flex-wrap justify-center gap-4"><a href="https://app.argonix.io/register" class="inline-flex items-center gap-3 rounded-full bg-gradient-to-r from-pink-500 via-rose-500 to-orange-400 px-8 py-4 text-lg font-bold text-white shadow-xl shadow-pink-500/30 transition hover:scale-105">🚀 Start Free Trial</a><a href="https://calendly.com/david-argonix/30min" target="_blank" class="inline-flex items-center gap-2 rounded-full bg-white px-8 py-4 text-lg font-bold text-neutral-700 shadow-lg ring-1 ring-neutral-200 transition hover:ring-pink-200">Book a Demo 📅</a></div>',3))]),e[14]||(e[14]=n('<section class="py-16"><h2 class="text-3xl font-extrabold text-center mb-4"><span class="bg-gradient-to-r from-emerald-600 via-cyan-600 to-violet-600 bg-clip-text text-transparent">One evidence chain from code to runtime</span></h2><p class="text-center text-neutral-600 max-w-3xl mx-auto mb-12">Argonix connects code, images, cloud resources, and observed activity to show what is vulnerable, exposed, and actually active.</p><div class="grid md:grid-cols-2 gap-8"><div class="rounded-3xl bg-gradient-to-br from-emerald-50 to-cyan-50 p-8 border border-emerald-100"><h3 class="text-xl font-extrabold text-neutral-800 mb-3">🗺️ Inventory &amp; context graph</h3><p class="text-neutral-600">Cloud and Kubernetes resources, workloads, identities, networks, databases, and secrets live in a relational inventory. Criticality, exposure, findings, attack paths, changes, and runtime activity stay attached to the same resource.</p></div><div class="rounded-3xl bg-gradient-to-br from-cyan-50 to-blue-50 p-8 border border-cyan-100"><h3 class="text-xl font-extrabold text-neutral-800 mb-3">⚡ Kernel/eBPF runtime with Tetragon</h3><p class="text-neutral-600">Argonix Sensor observes process execution and network connections on Linux Kubernetes nodes and VMs. Tetragon policies filter in the kernel; process enforcement follows observe, canary, approval, and rollback stages.</p></div><div class="rounded-3xl bg-gradient-to-br from-violet-50 to-purple-50 p-8 border border-violet-100"><h3 class="text-xl font-extrabold text-neutral-800 mb-3">🔎 Unified Security Operations</h3><p class="text-neutral-600">Threats, network evidence, processes, and exposure share one investigation workspace. A risky connection can be linked to its executable, workload, vulnerabilities, and source-code origin.</p></div><div class="rounded-3xl bg-gradient-to-br from-amber-50 to-orange-50 p-8 border border-amber-100"><h3 class="text-xl font-extrabold text-neutral-800 mb-3">🧾 Visible confidence, less noise</h3><p class="text-neutral-600">Deduplication, baselines, business criticality, and threat intelligence reduce noise. Every piece of evidence retains its source, timestamp, and confidence; missing data is never fabricated.</p></div></div></section><section class="py-16"><h2 class="text-3xl font-extrabold text-center mb-4"><span class="bg-gradient-to-r from-red-600 to-rose-500 bg-clip-text text-transparent">Cloud Security Posture Management</span></h2><p class="text-center text-neutral-600 max-w-2xl mx-auto mb-12">

1Automated security scans across your cloud infrastructure. Find misconfigurations before attackers do.</p><div class="grid md:grid-cols-2 gap-8"><div class="rounded-3xl bg-gradient-to-br from-red-50 to-rose-50 p-8 border border-red-100"><h3 class="text-xl font-extrabold text-neutral-800 mb-3">🔍 Security Scans</h3><p class="text-neutral-600">Scheduled or on-demand CSPM scans across AWS, GCP, Azure, and Kubernetes. Each scan produces findings with severity levels, resource identification, and remediation hints.</p></div><div class="rounded-3xl bg-gradient-to-br from-purple-50 to-violet-50 p-8 border border-purple-100"><h3 class="text-xl font-extrabold text-neutral-800 mb-3">📋 Security Findings</h3><p class="text-neutral-600">Findings with full context: severity (Critical→Info), resource type &amp; ID, provider &amp; region, CVSS score, risk score 0-100, remediation hints. Workflow: Open → Acknowledged → Resolved / False Positive.</p></div></div></section>',2)),t("section",y,[e[7]||(e[7]=t("h2",{class:"text-3xl font-extrabold text-center mb-4"},"Code Workbench — review, govern and follow through",-1)),e[8]||(e[8]=t("p",{class:"text-center text-neutral-600 max-w-3xl mx-auto mb-8"},"Repository projects with persistent issues, versioned rule profiles, new-code quality gates and commit-specific feedback. Follow the evidence from source to images and runtime, with missing context made explicit.",-1)),t("div",v,[r(s,{to:"/en/docs#security/workbench"},{default:o(()=>[...e[4]||(e[4]=[a("Explore the Workbench →",-1)])]),_:1}),r(s,{to:"/en/docs#security/code-quality"},{default:o(()=>[...e[5]||(e[5]=[a("Quality gates & CI →",-1)])]),_:1}),r(s,{to:"/en/docs#security/native-analyzers"},{default:o(()=>[...e[6]||(e[6]=[a("Language scope & activation →",-1)])]),_:1})]),e[9]||(e[9]=n('<div class="grid md:grid-cols-2 gap-8"><div class="rounded-3xl bg-gradient-to-br from-orange-50 to-amber-50 p-8 border border-orange-100"><h3 class="text-xl font-extrabold text-neutral-800 mb-3">Security scanning engines</h3><ul class="text-neutral-600 space-y-1 text-sm"><li><strong>SAST</strong> — OpenGrep: insecure code patterns and injection risks</li><li><strong>Secrets</strong> — Gitleaks: committed keys, passwords and tokens</li><li><strong>IaC</strong> — Checkov: Terraform, Kubernetes, Docker misconfigurations</li><li><strong>SCA / containers</strong> — Trivy: CVEs and vulnerable dependencies</li><li><strong>SBOM</strong> — Syft: versioned CycloneDX inventories</li><li><strong>DAST</strong> — OWASP ZAP: active testing on an authorized web app</li></ul></div><div class="rounded-3xl bg-gradient-to-br from-rose-50 to-red-50 p-8 border border-rose-100"><h3 class="text-xl font-extrabold text-neutral-800 mb-3">🔁 Per-commit, GitLab-Ultimate style</h3><p class="text-neutral-600">Signed GitHub and GitLab webhooks scan the exact commit. Pushes to your configured branch feed the persistent pipeline; other branches and merge requests run <strong>ephemeral</strong> scans that drive the deployment gate and post an MR/PR comment — without polluting your findings or your CVE hub.</p></div><div class="rounded-3xl bg-gradient-to-br from-violet-50 to-purple-50 p-8 border border-violet-100"><h3 class="text-xl font-extrabold text-neutral-800 mb-3">🎯 CVE triage, not finding spam</h3><p class="text-neutral-600">One CVE in 40 images is <strong>one</strong> triage decision. CVSS, EPSS exploitation probability, CISA KEV flag, fix versions from OSV.dev, blast radius, and priority scoring. Risk decisions — organization or project scope, structured reason, mandatory note, expiry — survive every rescan and stay auditable.</p></div><div class="rounded-3xl bg-gradient-to-br from-sky-50 to-blue-50 p-8 border border-sky-100"><h3 class="text-xl font-extrabold text-neutral-800 mb-3">📦 SBOM inventories</h3><p class="text-neutral-600">Versioned CycloneDX documents per target, component search and diffs between versions. Answer &quot;who ships log4j?&quot; instantly, without rescanning anything. Anything your own CI pushes lands in the same inventory.</p></div></div>',1))]),e[15]||(e[15]=n('<section class="py-16"><h2 class="text-3xl font-extrabold text-center mb-12"><span class="bg-gradient-to-r from-purple-600 to-indigo-500 bg-clip-text text-transparent">Compliance Frameworks</span></h2><div class="grid md:grid-cols-3 gap-6"><div class="rounded-2xl border border-neutral-200 bg-white p-6 shadow-sm text-center"><div class="text-3xl mb-3">🏛️</div><h3 class="text-lg font-extrabold text-neutral-800">ISO 27001</h3><p class="text-sm text-neutral-500 mt-2">Information security management system controls mapped to automated checks.</p></div><div class="rounded-2xl border border-neutral-200 bg-white p-6 shadow-sm text-center"><div class="text-3xl mb-3">🔐</div><h3 class="text-lg font-extrabold text-neutral-800">SOC 2</h3><p class="text-sm text-neutral-500 mt-2">Trust service criteria (Security, Availability, Confidentiality) with continuous evidence collection.</p></div><div class="rounded-2xl border border-neutral-200 bg-white p-6 shadow-sm text-center"><div class="text-3xl mb-3">🇪🇺</div><h3 class="text-lg font-extrabold text-neutral-800">NIS2</h3><p class="text-sm text-neutral-500 mt-2">EU Network and Information Security Directive compliance for essential and important entities.</p></div><div class="rounded-2xl border border-neutral-200 bg-white p-6 shadow-sm text-center"><div class="text-3xl mb-3">📏</div><h3 class="text-lg font-extrabold text-neutral-800">CIS Benchmarks</h3><p class="text-sm text-neutral-500 mt-2">CIS benchmarks for AWS, GCP, Azure, and Kubernetes. Automated checks against industry best practices.</p></div><div class="rounded-2xl border border-neutral-200 bg-white p-6 shadow-sm text-center"><div class="text-3xl mb-3">📊</div><h3 class="text-lg font-extrabold text-neutral-800">Custom Frameworks</h3><p class="text-sm text-neutral-500 mt-2">Define your own compliance framework with custom controls mapped to security checks.</p></div><div class="rounded-2xl border border-neutral-200 bg-white p-6 shadow-sm text-center"><div class="text-3xl mb-3">📈</div><h3 class="text-lg font-extrabold text-neutral-800">Compliance Dashboard</h3><p class="text-sm text-neutral-500 mt-2">Real-time compliance posture: pass/fail/warning per control, trend over time, exportable reports.</p></div></div></section><section class="py-16"><h2 class="text-3xl font-extrabold text-center mb-12"><span class="bg-gradient-to-r from-rose-500 to-red-600 bg-clip-text text-transparent">Runtime Detection &amp; Threat Correlation</span></h2><div class="grid md:grid-cols-2 gap-8"><div class="rounded-3xl bg-gradient-to-br from-rose-50 to-pink-50 p-8 border border-rose-100"><h3 class="text-xl font-extrabold text-neutral-800 mb-3">🎯 Detection Rules</h3><p class="text-neutral-600 mb-3">Five rule types for comprehensive threat coverage:</p><ul class="text-neutral-600 space-y-1 text-sm"><li><strong>Threshold</strong> — Alert when critical findings exceed a count in a time window</li><li><strong>Pattern</strong> — Regex matching on event titles and descriptions</li><li><strong>Sequence</strong> — Detect attack chains (Recon → Exploit → Exfiltration)</li><li><strong>Anomaly</strong> — Statistical deviation detection from baseline behavior</li><li><strong>AI Analysis</strong> — LLM-powered correlation across multiple security sources</li></ul></div><div class="rounded-3xl bg-gradient-to-br from-amber-50 to-orange-50 p-8 border border-amber-100"><h3 class="text-xl font-extrabold text-neutral-800 mb-3">

1⚡ Native sensor + AI analysis</h3><p class="text-neutral-600">Argonix detects runtime activity natively through Tetragon/eBPF and can ingest 20+ sources such as Falco, Wazuh, CrowdStrike, Sentinel, Snyk, and Trivy. Deterministic rules stay foundational; AI adds explainable cross-source correlation and MITRE ATT&amp;CK mapping.</p></div><div class="rounded-3xl bg-gradient-to-br from-indigo-50 to-violet-50 p-8 border border-indigo-100"><h3 class="text-xl font-extrabold text-neutral-800 mb-3">🛡️ Security Policies</h3><p class="text-neutral-600">Define security policies with compliance mappings and enforcement levels. Deployment gates that block non-compliant releases at the CI/CD level. Versioned and auditable.</p></div><div class="rounded-3xl bg-gradient-to-br from-sky-50 to-blue-50 p-8 border border-sky-100"><h3 class="text-xl font-extrabold text-neutral-800 mb-3">🌐 Threat Intelligence</h3><p class="text-neutral-600">Automatic enrichment of security events with IP/domain intelligence from AbuseIPDB, OTX, and VirusTotal. Chronological event timeline with full chain of custody.</p></div></div></section><section class="py-16"><h2 class="text-3xl font-extrabold text-center mb-4"><span class="bg-gradient-to-r from-orange-500 to-red-500 bg-clip-text text-transparent">20+ Security Alert Sources</span></h2><p class="text-center text-neutral-600 max-w-2xl mx-auto mb-12">Ingest security events from your entire security stack. Centralize, correlate, and respond.</p><div class="flex flex-wrap justify-center gap-3 max-w-3xl mx-auto"><span class="rounded-full bg-red-50 border border-red-200 px-4 py-2 text-sm font-semibold text-red-700">Falco</span><span class="rounded-full bg-red-50 border border-red-200 px-4 py-2 text-sm font-semibold text-red-700">Wazuh</span><span class="rounded-full bg-red-50 border border-red-200 px-4 py-2 text-sm font-semibold text-red-700">CrowdStrike</span><span class="rounded-full bg-red-50 border border-red-200 px-4 py-2 text-sm font-semibold text-red-700">Microsoft Sentinel</span><span class="rounded-full bg-orange-50 border border-orange-200 px-4 py-2 text-sm font-semibold text-orange-700">Wiz</span><span class="rounded-full bg-orange-50 border border-orange-200 px-4 py-2 text-sm font-semibold text-orange-700">Snyk</span><span class="rounded-full bg-orange-50 border border-orange-200 px-4 py-2 text-sm font-semibold text-orange-700">Trivy</span><span class="rounded-full bg-orange-50 border border-orange-200 px-4 py-2 text-sm font-semibold text-orange-700">Semgrep</span><span class="rounded-full bg-amber-50 border border-amber-200 px-4 py-2 text-sm font-semibold text-amber-700">SonarQube</span><span class="rounded-full bg-amber-50 border border-amber-200 px-4 py-2 text-sm font-semibold text-amber-700">OWASP ZAP</span><span class="rounded-full bg-amber-50 border border-amber-200 px-4 py-2 text-sm font-semibold text-amber-700">Nuclei</span><span class="rounded-full bg-amber-50 border border-amber-200 px-4 py-2 text-sm font-semibold text-amber-700">Kubescape</span><span class="rounded-full bg-purple-50 border border-purple-200 px-4 py-2 text-sm font-semibold text-purple-700">Prometheus Alertmanager</span><span class="rounded-full bg-purple-50 border border-purple-200 px-4 py-2 text-sm font-semibold text-purple-700">Grafana</span><span class="rounded-full bg-purple-50 border border-purple-200 px-4 py-2 text-sm font-semibold text-purple-700">Datadog</span><span class="rounded-full bg-purple-50 border border-purple-200 px-4 py-2 text-sm font-semibold text-purple-700">PagerDuty</span></div></section>',3)),t("section",w,[e[13]||(e[13]=t("h2",{class:"text-3xl font-extrabold text-center mb-8"},[t("span",{class:"bg-gradient-to-r from-red-500 to-purple-500 bg-clip-text text-transparent"},"Explore More")],-1)),t("div",S,[r(s,{to:"/en/ai-incident-response",class:"rounded-2xl border border-neutral-200 bg-white p-6 shadow-sm transition hover:shadow-md hover:border-red-200 block"},{default:o(()=>[...e[10]||(e[10]=[t("h3",{class:"text-lg font-extrabold text-neutral-800 mb-2"},"AI Incident Response →",-1),t("p",{class:"text-sm text-neutral-500"},"When threats are detected, AI responds.",-1)])]),_:1}),r(s,{to:"/en/argos-ai-agent",class:"rounded-2xl border border-neutral-200 bg-white p-6 shadow-sm transition hover:shadow-md hover:border-red-200 block"},{default:o(()=>[...e[11]||(e[11]=[t("h3",{class:"text-lg font-extrabold text-neutral-800 mb-2"},"Argos AI Agent →",-1),t("p",{class:"text-sm text-neutral-500"},"The AI agent powering security analysis.",-1)])]),_:1}),r(s,{to:"/en/monitoring-platform",class:"rounded-2xl border border-neutral-200 bg-white p-6 shadow-sm transition hover:shadow-md hover:border-red-200 block"},{default:o(()=>[...e[12]||(e[12]=[t("h3",{class:"text-lg font-extrabold text-neutral-800 mb-2"},"Monitoring Platform →",-1),t("p",{class:"text-sm text-neutral-500"},"Complete uptime and performance monitoring.",-1)])]),_:1})])]),e[16]||(e[16]=n('<section class="py-16"><h2 class="text-3xl font-extrabold text-center mb-12"><span class="bg-gradient-to-r from-pink-600 to-orange-500 bg-clip-text text-transparent">Frequently Asked Questions</span></h2><div class="mx-auto max-w-3xl space-y-4"><details class="rounded-2xl border border-neutral-200 bg-white p-6 shadow-sm"><summary class="cursor-pointer text-lg font-bold text-neutral-800">Which cloud providers are supported?</summary><p class="mt-4 text-neutral-600">AWS, GCP, Azure, and Kubernetes clusters (any provider). CSPM checks cover IAM, networking, storage, compute, and more for each platform.</p></details>

1<details class="rounded-2xl border border-neutral-200 bg-white p-6 shadow-sm"><summary class="cursor-pointer text-lg font-bold text-neutral-800">How does AI threat detection work?</summary><p class="mt-4 text-neutral-600">Detection rules with AI Analysis type send recent security events to your configured LLM, which acts as a SOC analyst. It correlates events across multiple sources and identifies complex attack patterns (lateral movement, privilege escalation) that rule-based systems miss.</p></details><details class="rounded-2xl border border-neutral-200 bg-white p-6 shadow-sm"><summary class="cursor-pointer text-lg font-bold text-neutral-800">Can I block deployments based on security findings?</summary><p class="mt-4 text-neutral-600">Yes. Security Policies with Deployment Gates act as quality gates in your CI/CD pipeline. If a scan finds critical issues that violate your policy, the deployment is blocked until they&#39;re resolved.</p></details><details class="rounded-2xl border border-neutral-200 bg-white p-6 shadow-sm"><summary class="cursor-pointer text-lg font-bold text-neutral-800">Is it suitable for compliance audits?</summary><p class="mt-4 text-neutral-600">Absolutely. Compliance dashboards provide real-time posture for ISO 27001, SOC 2, NIS2, and CIS Benchmarks. Evidence is collected continuously — no more quarterly panic before audits.</p></details></div></section><section class="py-16 text-center"><div class="rounded-3xl bg-gradient-to-br from-red-50 via-rose-50 to-purple-50 border border-red-200 p-12 shadow-lg"><h2 class="text-3xl font-extrabold md:text-4xl"><span class="bg-gradient-to-r from-red-500 via-rose-500 to-purple-600 bg-clip-text text-transparent">Continuous Compliance, Not Quarterly Panic</span></h2><p class="mt-4 text-lg text-neutral-600 max-w-xl mx-auto">CSPM, threat detection, AI analysis, and deployment gates. Secure your cloud posture continuously.</p><div class="mt-8"><a href="https://app.argonix.io/register" class="inline-flex items-center gap-3 rounded-full bg-gradient-to-r from-pink-500 via-rose-500 to-orange-400 px-10 py-5 text-lg font-bold text-white shadow-xl shadow-pink-500/30 transition hover:scale-105">🚀 Start Free Trial</a></div></div></section>',2))]),t("footer",k,[t("div",C,[t("p",null,"© "+c(new Date().getFullYear())+" Argonix. All rights reserved.",1)])])])}}};export{M as default};