52. Runtime security and incident response

Detect suspicious processes, file changes, privilege escalation, and unusual network activity in running clusters. Prepare audit trails, containment actions, credential rotation, forensic collection, and recovery procedures for Kubernetes incidents.