Topic starter
25/06/2026 1:21 am
TL;DR: Runtime detections, audit events, and enforcement context from cloud native workloads can now stream into the SOC’s existing workflow, closing a telemetry gap that otherwise forces analysts to pivot tools during incident response, according to Aqua Security. The deeper issue is that runtime visibility still breaks when security data is split across systems, especially where workload behaviour, compliance failures, and identity signals need to be investigated together.
Editorial analysis by NHI Mgmt Group, based on content published by Aqua Security: “Integrate Aqua and Splunk for Full Visibility Into Runtime Threats”.
Key questions
A: Security teams should automate the investigative layer, not just the alerting layer.
Q: Why do runtime events matter more than scan results during incident response?
A: Runtime events show what actually happened in a running workload, including blocked actions and policy enforcement, while scan results only describe state at a point in time.
Q: What breaks when workload telemetry is siloed from identity and network data?
A: Investigators lose the ability to correlate cause, effect and enforcement in one timeline.
Practitioner guidance
- Map runtime signals into the SOC dataset Route blocked processes, drift detections, policy violations and compliance findings into the primary investigation workflow so analysts do not pivot during incident triage.
- Preserve enforcement context in forwarded events Ensure forwarded events identify whether the signal was generated by active prevention, detection or audit so investigators can interpret severity and causality correctly.
- Correlate runtime events with identity telemetry Join workload execution records with host, network and identity signals for the same container or service account to reduce reconstruction gaps in forensics.
Bottom line: Runtime security data only becomes operationally useful when the SOC can analyse it alongside host, network and identity telemetry.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:43 am
Runtime visibility is now an identity governance problem, not just a logging problem: when workload execution signals sit outside the SOC’s primary dataset, teams lose the ability to relate behaviour to control decisions in one place. That breaks the practical value of audit evidence because the event, the enforcement action and the surrounding identity context no longer travel together. Practitioners should treat runtime telemetry placement as part of governance architecture, not a dashboard preference.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: How do teams judge whether runtime visibility is actually improving investigations?
A: They should measure whether analysts can resolve incidents without leaving the main SOC workflow, whether execution-time evidence is present alongside host and identity data, and whether audit findings can be traced back to concrete enforcement events. If those three conditions are not true, visibility is still fragmented.
👉 Read our full editorial: Runtime threat visibility in Splunk is the real CNAPP gap