Welcome, ...

Getting Started

1. Install the admission webhook

One-time, cluster-wide. Run in your Kubernetes cluster:

2. Prepare each app namespace

One-time per namespace. The webhook runs in pando-system, but your workloads live in their own namespaces — each needs a copy of the license Secret and a pando-sidecar ServiceAccount.

NS=your-app-namespace

# Copy the license secret into the app namespace
kubectl get secret pando-license -n pando-system -o yaml \
  | sed "s/namespace: pando-system/namespace: $NS/" \
  | kubectl apply -f -

# Create the sidecar service account + role binding
kubectl create serviceaccount pando-sidecar -n $NS
kubectl create rolebinding pando-sidecar \
  --clusterrole=pando-sidecar \
  --serviceaccount=$NS:pando-sidecar -n $NS

3. Protect a deployment

Label the deployment and restart. The sidecar is injected on the next pod start.

4. Verify it's working

Confirm the sidecar injected and is reporting.

# Confirm sidecar injected (should show 2/2)
kubectl get pods -l app=your-app

# Watch the sidecar come up
kubectl logs -f <pod-name> -c pando-sidecar

# Readiness (503 during learning, 200 after)
kubectl exec <pod-name> -c pando-sidecar -- wget -qO- http://localhost:9090/readyz

# Detection metrics
kubectl exec <pod-name> -c pando-sidecar -- wget -qO- http://localhost:9090/metrics

See full documentation.

SIEM Destinations

Forward PandoCore detection events directly to your SIEM. Credentials are encrypted at rest; they never appear in Helm values or pod specs. Up to one destination per type. Changes reach your sidecars on the next config refresh — no redeploy needed.

Slack Alerts

Post a formatted alert to a Slack channel on every detection. Configured per workload via a sidecar environment variable — set your Slack incoming webhook URL and apply it to the deployment:

kubectl set env deployment/<your-app> -c pando-sidecar \
  PANDO_SLACK_WEBHOOK_URL="https://hooks.slack.com/services/XXX/YYY/ZZZ"

Alerts fire in alert and enforce modes. Optional: PANDO_ALERT_TIMEOUT_SECONDS (default 5). Fleet-wide via a PandoCorePolicy integrations.slack. See operating modes.

Webhook

Deliver the full evidence record to any HTTPS endpoint for custom routing or storage. Configured per workload via sidecar environment variables:

kubectl set env deployment/<your-app> -c pando-sidecar \
  PANDO_EVIDENCE_WEBHOOK_URL="https://example.com/ingest/pando" \
  PANDO_WEBHOOK_FORMAT="ecs"

PANDO_WEBHOOK_FORMAT: native (default) or ecs (ECS 8.11). Optional: PANDO_EVIDENCE_WEBHOOK_TIMEOUT_SECONDS, PANDO_EVIDENCE_WEBHOOK_MAX_RETRIES. See evidence format.