We rely on the policies that we have created to make decisions when there is a breach.

Good monitoring of hosts' metrics (CPU, memory, etc.), great monitoring of containers over Mesos (taking into account resource limits), network traffic, and errors.