name: Kubernetes Azure detect most active service accounts by pod namespace
id: 55a2264a-b7f0-45e5-addd-1e5ab3415c72
version: 1
date: '2020-05-26'
author: Rod Soto, Splunk
type: batch
datamodel: []
description: This search provides information on Kubernetes service accounts,accessing
  pods and namespaces by IP address and verb
search: '`kubernetes_azure` category=kube-audit | spath input=properties.log | search
  user.groups{}=system:serviceaccounts* OR user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow  |
  table  sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status
  properties.pod objectRef.namespace | top sourceIPs{} user.username verb responseStatus.status
  properties.pod objectRef.namespace |`kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter`'
how_to_implement: You must install the Add-on for Microsoft Cloud Services and Configure
  Kube-Audit data diagnostics
known_false_positives: Not all service accounts interactions are malicious. Analyst
  must consider IP and verb context when trying to detect maliciousness.
references: []
tags:
  analytic_story:
  - Kubernetes Sensitive Role Activity
  asset_type: Azure AKS Kubernetes cluster
  kill_chain_phases:
  - Lateral Movement
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  security_domain: threat
