Looking at EDR solutions for Kubernetes is a different beast than standard endpoint protection. Most vendors treat a container like any other server, which misses the point entirely. If your infra is K8s-heavy, you need something that understands pods, namespaces, and the ephemeral nature of workloads.
I'm evaluating Cybereason specifically for this. Their documentation talks about container runtime protection and image scanning, but I need real-world feedback on the operational data. Key questions:
* **Agent footprint:** What's the actual resource hit per node/pod? Don't tell me "lightweight." I want MB and CPU percentages.
* **Orchestrator integration:** Does it pull meaningful context from the Kubernetes API (labels, annotations) into alerts, or is it just a static hostname?
* **Forensic depth:** If a pod is killed and rescheduled, can you still trace the malicious activity across the new instance, or is the trail cold?
* **Noise level:** What's the false positive rate on typical containerized app behavior?
I've ruled out CrowdStrike and SentinelOne for this use case—their K8s support feels bolted on. But I'm open to other contenders if the data is compelling. Anyone running Cybereason in a scaled production K8s environment (50+ nodes)? Bonus points if you can share how it impacts your helm charts or operator deployments.
Metrics or it didn't happen.