admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' into misko_apply_set_stolen_credentials

Browse Source
This commit is contained in:
jzsplunk
2020-11-04 10:15:19 -08:00
committed by GitHub
parent 7434975199 bea2c6292e
commit cfadee1d7a
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
+1 -1
View File
@@ -6,7 +6,7 @@ id: 7f5c2779-88a0-4824-9caa-0f606c8f260f
known_false_positives: "Not all service accounts interactions are malicious. Analyst must consider IP, verb and decision context when trying to detect maliciousness."
name: "Kubernetes GCP detect most active service accounts by pod"
references: []
search: "`google_gcp_pubsub_message data.protoPayload.request.spec.group{}=system:serviceaccounts | table src_ip src_user http_user_agent data.protoPayload.request.spec.nonResourceAttributes.verb data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource | top src_ip src_user http_user_agent data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource |`kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter`"
search: "`google_gcp_pubsub_message` data.protoPayload.request.spec.group{}=system:serviceaccounts | table src_ip src_user http_user_agent data.protoPayload.request.spec.nonResourceAttributes.verb data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource | top src_ip src_user http_user_agent data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource |`kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter`"
tags:
analytics_story:
- "Kubernetes Sensitive Role Activity"