name: Kubernetes Azure detect service accounts forbidden failure access
id: 019690d7-420f-4da0-b320-f27b09961514
version: 1
date: '2020-05-20'
author: Rod Soto, Splunk
type: batch
datamodel: []
description: This search provides information on Kubernetes service accounts with
  failure or forbidden access status
search: '`kubernetes_azure` category=kube-audit | spath input=properties.log | search
  user.groups{}=system:serviceaccounts*  responseStatus.reason=Forbidden | table  sourceIPs{}
  user.username userAgent verb responseStatus.reason responseStatus.status properties.pod
  objectRef.namespace  |`kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter`'
how_to_implement: You must install the Add-on for Microsoft Cloud Services and Configure
  Kube-Audit data diagnostics
known_false_positives: This search can give false positives as there might be inherent
  issues with authentications and permissions at cluster.
references: []
tags:
  analytic_story:
  - Kubernetes Sensitive Object Access Activity
  asset_type: Azure AKS Kubernetes cluster
  kill_chain_phases:
  - Lateral Movement
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  security_domain: threat
