Workload & Cloud Security Powered by Runtime Insights

Cloud Security

Engagement Highlights - QA

  1. UI Automation of complex react components and graphs using playwright/typescript. Frontend UI Automation using Selenium & Java. 
  2. Automated E2E solutions for container vulnerability scanning features using Python/Pytest. 
  3. Continuous Integration & Testing of features using Jenkins and GitHub Workflows.  
Sysdig Logo

Sysdig Introduction

Sysdig, the industry’s only cloud security platform, delivers the breadth of coverage and depth of insight required to protect cloud environments. Sysdig consolidates cloud security by combining security events, vulnerabilities, posture data, and permissions and powering it all with runtime insights, which helps stop cloud and container attacks with no wasted time. Thus, taking cloud security to the next level with AI. 

Challenges & Goals

Neova team was tasked to perform end-to-end testing of Sysdig’s application. Below are the key areas identified for the Neova team to focus on:

  1. Explore and gain in-depth knowledge of Sysdig’s core products.
  2. Streamlining product development process to focus on Quality Assurance. 
  3. Implement the measures to expedite the QA Operations.
  4. Provide comprehensive automated suites to test the complex Dashboard UI, Backend & Infrastructure.

Solutions

After getting a clear understanding of the requirements of the end user, the following automation testing scripts were implemented: 

  1. Automated UI Testing: The Neova team performed functional & selenium-based automated testing, that included cross-browser testing on major browsers like Chrome, Firefox, Safari & Microsoft Edge. Our specialized strategies included testing the complex front-end web application built using React JS. Data visualization graphs, that are built using vis.js were automated using Playwright & TypeScript. 
  2. Workload Agent Testing:  Sysdig Agents monitor Workload Hosts, Containers, Kubernetes Clusters & Pod Namespaces to detect any threat event.  Our Automated solutions included spinning Kubernetes cluster (EKS, AKS, GKE) to install Agents. Provision of the cluster to generate a variety of User Activities for Threat detection.  Configure and Validate the Agent functioning using API’s. We used kubectl, kops, shell scripting, terraform, ansible, docker, python & java.
  3. Vulnerability Scanner: Sysdig supports docker vulnerability scanners to detect vulnerabilities.  Our E2E Automated solutions included creating a variety of docker images and pushing them to the docker registries (ECR, Artifact Registry, DockerHub, ACR). Sysdig scanners would generate vulnerability CVE’s report. We validated these results for correctness using APIs and CVE databases.  Docker, python, pytest & shell scripts were used for the implementations. 
  4. CI & DevOps: We achieved Continuous Integration & Testing of various activities via pipelined jobs using Jenkins & Slack Reporting. Application Integration testing was performed with 3rd party providers like Service Now, PagerDuty, MCM, QRadar, Sentinel, New Relic, Splunk, & Webhooks.