From 6ea36044817ca79deb740645c42e8f88882a90d3 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Thu, 25 Jun 2020 14:36:18 -0400 Subject: [PATCH] fixedaddedcondition --- detections/kubernetes_azure_detect_sensitive_object_access.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/kubernetes_azure_detect_sensitive_object_access.yml b/detections/kubernetes_azure_detect_sensitive_object_access.yml index b24ed7a2b2..95b86696f1 100644 --- a/detections/kubernetes_azure_detect_sensitive_object_access.yml +++ b/detections/kubernetes_azure_detect_sensitive_object_access.yml @@ -6,7 +6,7 @@ id: 1bba382b-07fd-4ffa-b390-8002739b76e8 known_false_positives: "Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection." name: "Azure AKS Kubernetes cluster sensitive object access detection" references: [] -search: "sourcetype=mscs:storage:blob:json index=azure_test category=kube-audit | spath input=properties.log| search objectRef.resource=secrets OR configmaps |table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_object_access`" +search: "sourcetype=mscs:storage:blob:json category=kube-audit | spath input=properties.log| search objectRef.resource=secrets OR configmaps user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow |table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_object_access`" tags: analytics_story: - "Kubernetes Sensitive Object Access Activity"