> For the complete documentation index, see [llms.txt](https://docs.opsmx.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.opsmx.com/code-to-cloud-security-and-scanners/runtime-security/runtime-signals.md).

# Runtime Signals

Runtime Signals are the real-time data inputs that power effective runtime security in Delivery Shield — representing continuously collected data from applications, containers, infrastructure, and user interactions. These signals provide visibility into how systems actually behave under operating conditions, enabling the detection of anomalies that indicate potential threats.

Runtime Signals include process activity, network traffic patterns, API call volumes, system logs, access patterns, file system events, and resource consumption metrics.

## **How Runtime Signals Work in OpsMx**

Delivery Shield correlates signals across multiple sources to establish a **behavioral baseline** for each workload, service, and environment. Deviations from this baseline are flagged as potential risks.

| Signal Type          | Examples                                             | What It Detects                           |
| -------------------- | ---------------------------------------------------- | ----------------------------------------- |
| **Process Activity** | Unexpected process execution inside containers       | Container breakout, malware execution     |
| **Network Traffic**  | Unusual outbound connections, port scanning          | Data exfiltration, C2 communication       |
| **API Calls**        | Abnormal call volumes, unexpected endpoints accessed | API abuse, unauthorized access            |
| **System Logs**      | Authentication failures, privilege use               | Credential attacks, insider threats       |
| **Resource Usage**   | CPU/memory spikes, storage anomalies                 | Cryptomining, resource abuse              |
| **Access Patterns**  | Unusual user or service account behavior             | Compromised credentials, lateral movement |

### **Key Characteristics**

* **Contextual** — tied to specific workloads, services, or users for precise attribution
* **Continuous** — collected in real time across all connected environments
* **Correlated** — combined across multiple signal sources for deeper, more accurate insights
* **Actionable** — linked directly to remediation workflows, not just alert dashboards

## **Benefits for the User**

* Security teams gain real-time visibility into production behavior without requiring agents or code instrumentation changes
* Signals feed directly into analytics and trend analysis — enabling proactive risk identification before incidents occur
* Runtime findings are linked back to code versions and deployment records for root-cause tracing