KubeHound: Identifying attack paths in Kubernetes clusters

This report introduces KubeHound, an open-source tool by Datadog that builds a graph of Kubernetes entities and attack edges to visualize and query attack paths, shifting defenders from list-based to graph-based security. It shows how to identify critical paths from exposed endpoints to high-privilege roles, quantify remediation impact (e.g., reducing TOKEN_BRUTEFORCE-based paths), scope investigations, and track risk metrics, while detailing its Gremlin-based DSL, deployment workflow, and modular architecture.