{
  "id": "skill-area:runtime-security",
  "_kind": "SkillArea",
  "_file": "domain/skill-areas/skill-areas-ecosystem-expansion.yaml",
  "_cluster": "domain",
  "attributes": {
    "displayName": "Runtime Security",
    "description": "Protecting applications and infrastructure at runtime — eBPF-based threat\ndetection, syscall filtering, container isolation, anomaly detection, and\nreal-time response using tools like Falco, Tetragon, and AppArmor.\n",
    "domains": [
      "domain:cybersecurity"
    ],
    "expertiseLevels": [
      "intermediate",
      "expert"
    ]
  },
  "outgoingEdges": [
    {
      "from": "skill-area:runtime-security",
      "to": "domain:cybersecurity",
      "kind": "applies_to",
      "attributes": {
        "confidence": "primary"
      }
    }
  ],
  "incomingEdges": [
    {
      "from": "skill-area:application-security",
      "to": "skill-area:runtime-security",
      "kind": "prerequisite_for_learning",
      "attributes": {
        "strength": "recommended"
      }
    },
    {
      "from": "stack-profile:security-operations",
      "to": "skill-area:runtime-security",
      "kind": "requires_skill_area"
    },
    {
      "from": "tool:trivy",
      "to": "skill-area:runtime-security",
      "kind": "used_for"
    },
    {
      "from": "tool:falco",
      "to": "skill-area:runtime-security",
      "kind": "tool_used_by",
      "attributes": {}
    },
    {
      "from": "tool:falco",
      "to": "skill-area:runtime-security",
      "kind": "used_for"
    },
    {
      "from": "tool:checkov",
      "to": "skill-area:runtime-security",
      "kind": "used_for"
    },
    {
      "from": "tool:tfsec",
      "to": "skill-area:runtime-security",
      "kind": "used_for"
    }
  ]
}