Contain-Detect-Eliminate is the Containment Era security sequence Aviatrix operates on: bound what a compromised workload can reach first, detect the threat inside that bounded space, then eliminate it at the source. The order is deliberate. Most architectures detect first and contain after, which means the Blast Radius is still expanding when the first alert fires. Aviatrix enforces Communication Governance at every workload before any alert, so by the time Suricata identifies a threat the attacker is already operating in a finite, bounded space. Detection becomes faster and more precise because the surface it watches is small.

What is Contain-Detect-Eliminate, and why does the order matter?

Suricata, the open-source engine governed by OISF, has run inline as the core intrusion prevention system inside the Aviatrix platform since its integration. It performs deep packet inspection, processes custom rulesets, decrypts TLS traffic for full visibility, and feeds the Distributed Cloud Firewall enforcement layer. As a consortium member, Aviatrix contributes engineering resources, multicloud reference architectures for AWS, Azure, and GCP, and cloud native detection rule sets covering IAM lateral movement, instance metadata service abuse, Kubernetes service token theft, and Cascade-class supply chain attack patterns. Every Suricata deployment worldwide benefits, not only Aviatrix customers.

Why is Aviatrix joining the Open Information Security Foundation (OISF)?

Aviatrix ships 556 purpose-built Suricata rules covering AI-specific threat categories: prompt injection and jailbreak detection, sensitive data leakage, malicious tool usage, data exfiltration, agent-to-agent threats, and malicious file uploads. The rules run inline within the Aviatrix traffic inspection pipeline after TLS termination and decryption, and were validated against live gateway traffic with zero false positives against benign traffic. This is detection depth no general-purpose ruleset was built to deliver.

How does Aviatrix detect AI workload threats?

Aviatrix stops it at each stage of Contain-Detect-Eliminate. Consider an AI agent asked to build a slide deck that reads confidential roadmap data from Confluence and tries to upload it to a public file-sharing site. Contain: egress policy locks down risky Model Context Protocol servers before the upload begins. Detect: Suricata identifies the bulk encoded payload in outbound traffic and drops the connection inline. Eliminate: every blocked attempt fires a critical alert to the security operations center with full policy citation, source workload, and destination. The confidential data never leaves the environment.

How does Aviatrix stop an AI agent from exfiltrating confidential data?

A chokepoint governs only the traffic that routes through it, so Kubernetes pod egress, serverless functions, east-west traffic between Virtual Private Clouds, and newly deployed workloads can all move outside its view. Containment Architecture enforces policy at every workload, every path, and every region, and propagates automatically to new workloads the moment they are deployed. In Aviatrix, the Distributed Cloud Firewall and Suricata run on one shared data path, so containment, detection, and elimination operate as a single system rather than separate tools.

How is Containment Architecture different from chokepoint security?

Containment is the architectural enforcement of explicit communication policy at every workload — governing what it can reach and what can reach it, at the granularity of workload identity and protocol — on every path available to it, independent of whether a compromise has been detected. In other words, containment is not a reaction that triggers after a threat is spotted; it is enforced by architecture before, during, and after a breach. This is what makes the sequence work: because Communication Governance has already bounded what any workload can reach, a compromised workload is operating in a finite space the moment it lands, and detection and elimination follow inside that boundary. As the principle goes: when prevention fails and detection is too slow, containment decides whether the incident becomes a catastrophic breach.

What is containment in the Containment Era?

Contain. Detect. Eliminate. Aviatrix Deepens Its Investment in the Full Model.

Learn why Aviatrix joined OISF and how its investment in Suricata helps advance open-source threat detection, cloud security, IDS/IPS capabilities, and multi-cloud protection across AWS, Azure, and GCP.

Janani Rajendiran

Author Biography

Published Articles by Janani Rajendiran

Contain. Detect. Eliminate. Aviatrix Deepens Its Investment in the Full Model.

Products

By Role

Customer Stories

Security & Legal

Solutions

Resources

Industry

Company

Tools