Topic starter
25/06/2026 1:21 am
TL;DR: Runtime evidence still loses operational value when it sits apart from host, network and identity data, according to Aqua Security. Splunk needs execution-time context tied to the SOC timeline so analysts can reconstruct incidents and compliance findings without jumping tools.
Editorial analysis by NHI Mgmt Group, based on content published by Aqua Security: “Integrate Aqua and Splunk for Full Visibility Into Runtime Threats”.
Key questions
Q: Why do runtime events matter more than scan results during incident response?
A: Runtime events show what actually happened in a running workload, including blocked actions and policy enforcement, while scan results only describe state at a point in time.
Q: What breaks when workload telemetry is siloed from identity and network data?
A: Investigators lose the ability to correlate cause, effect and enforcement in one timeline.
A: Security teams should automate the investigative layer, not just the alerting layer.
Practitioner guidance
- Map runtime signals into the SOC dataset Route blocked processes, drift detections, policy violations and compliance findings into the primary investigation workflow so analysts do not pivot during incident triage.
- Preserve enforcement context in forwarded events Ensure forwarded events identify whether the signal was generated by active prevention, detection or audit so investigators can interpret severity and causality correctly.
- Correlate runtime events with identity telemetry Join workload execution records with host, network and identity signals for the same container or service account to reduce reconstruction gaps in forensics.
Bottom line: Runtime security data only becomes operationally useful when the SOC can analyse it alongside host, network and identity telemetry.
Glossary terms: Runtime telemetry, Execution-Time Evidence, Enforcement context, SOC Investigation Workflow
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 10:43 am
Runtime visibility is now an identity governance problem, not just a logging problem: when workload execution signals sit outside the SOC’s primary dataset, teams lose the ability to relate behaviour to control decisions in one place. That breaks the practical value of audit evidence because the event, the enforcement action and the surrounding identity context no longer travel together. Practitioners should treat runtime telemetry placement as part of governance architecture, not a dashboard preference.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: How do teams judge whether runtime visibility is actually improving investigations?
A: They should measure whether analysts can resolve incidents without leaving the main SOC workflow, whether execution-time evidence is present alongside host and identity data, and whether audit findings can be traced back to concrete enforcement events. If those three conditions are not true, visibility is still fragmented.
👉 Read our full editorial: Runtime threat visibility in Splunk is the real CNAPP gap