name: Kubernetes Sensitive Role Activity
id: 2574e6d9-7254-4751-8925-0447deeec8ew
version: 1
date: '2020-05-20'
author: Rod Soto, Splunk
type: batch
description: This story addresses detection and response around Sensitive Role usage
  within a Kubernetes clusters against cluster resources and namespaces.
narrative: Kubernetes is the most used container orchestration platform, this orchestration
  platform contains sensitive roles within its architecture, specifically configmaps
  and secrets, if accessed by an attacker can lead to further compromise. These searches
  allow operator to detect suspicious requests against Kubernetes role activities
references:
- https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html
tags:
  analytic_story: Kubernetes Sensitive Role Activity
  category:
  - Cloud Security
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  usecase: Security Monitoring
