How should runtime detection and response be designed for production in Container Security?

Baseline expected behavior, alert on high-confidence deviations, correlate with Kubernetes identity, and define containment runbooks.