To see the behavior models for a Kubernetes workload, perform the following procedure.


  1. On the left navigation pane, do one of the following depending on your system configuration and role:
    • If you have the Kubernetes Security DevOps or SecOps role and your system has only the Container security feature, click Inventory > Workloads.
    • If you have any other role and your system has Container security and other Carbon Black Cloud features, click Inventory > Kubernetes > Workloads.
  2. Click the hyperlinked name of the Workload in the second column.
  3. Click Behavior Models.
    The Behavior Models page contains four tabs: Network model, Process activity model, File access model, and Resource usage model.
    • Network model

      This tab displays the process name, traffic direction, remote host, remote group, port, and protocol of the transmission.

    • Process activity model

      This tab displays a process tree. For example:

      Example process tree

    • File access model

      Displays process, file, and access type.

    • Resource usage model