admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #524 from splunk/awsgcpk8s

Browse Source 
Awsgcpk8s
This commit is contained in:
Bhavin Patel
2020-06-25 13:34:46 -07:00
committed by GitHub
parent 4b13ddff94 957b39837f
commit 0cf88ffdc2
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml
+1 -1
View File
@@ -6,7 +6,7 @@ id: 55a2264a-b7f0-45e5-addd-1e5ab3415c72
known_false_positives: "Not all service accounts interactions are malicious. Analyst must consider IP and verb context when trying to detect maliciousness."
name: "Kubernetes Azure detect most active service accounts by pod namespace"
references: []
search: "sourcetype:mscs:storage:blob:json category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts* | table sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace | top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace |`kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter`"
search: "`kubernetes_azure` category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts* OR user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow | table sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace | top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace |`kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter`"
tags:
analytics_story:
- "Kubernetes Sensitive Role Activity"
detections/kubernetes_azure_detect_sensitive_object_access.yml
+1 -1
View File
@@ -6,7 +6,7 @@ id: 1bba382b-07fd-4ffa-b390-8002739b76e8
known_false_positives: "Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection."
name: "Kubernetes Azure detect sensitive object access"
references: []
search: "`kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=secrets OR configmaps |table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_object_access_filter`"
search: "`kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=secrets OR configmaps user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow |table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_object_access_filter`"
tags:
analytics_story:
- "Kubernetes Sensitive Object Access Activity"