From eb268874bd3ae8a1c00888f4b8c43af68c2bcf76 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Thu, 29 Oct 2020 12:09:16 -0400 Subject: [PATCH] Update kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml --- ...ubernetes_gcp_detect_most_active_service_accounts_by_pod.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml b/detections/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml index 3a42b2749f..cd214b7b56 100644 --- a/detections/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml +++ b/detections/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml @@ -6,7 +6,7 @@ id: 7f5c2779-88a0-4824-9caa-0f606c8f260f known_false_positives: "Not all service accounts interactions are malicious. Analyst must consider IP, verb and decision context when trying to detect maliciousness." name: "Kubernetes GCP detect most active service accounts by pod" references: [] -search: "`google_gcp_pubsub_message data.protoPayload.request.spec.group{}=system:serviceaccounts | table src_ip src_user http_user_agent data.protoPayload.request.spec.nonResourceAttributes.verb data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource | top src_ip src_user http_user_agent data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource |`kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter`" +search: "`google_gcp_pubsub_message` data.protoPayload.request.spec.group{}=system:serviceaccounts | table src_ip src_user http_user_agent data.protoPayload.request.spec.nonResourceAttributes.verb data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource | top src_ip src_user http_user_agent data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource |`kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter`" tags: analytics_story: - "Kubernetes Sensitive Role Activity"