mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Lou Stella
71 lines
2.7 KiB
YAML
71 lines
2.7 KiB
YAML
name: Kubernetes Audit
|
|
id: 6c25181a-0c07-4aaf-90e6-77ab1f0e6699
|
|
version: 2
|
|
date: '2025-01-23'
|
|
author: Patrick Bareiss, Splunk
|
|
description: Logs activities within a Kubernetes cluster, including API server requests,
|
|
resource access, configuration changes, and user authentication events.
|
|
mitre_components:
|
|
- Pod Metadata
|
|
- Pod Modification
|
|
- Cluster Metadata
|
|
- User Account Authentication
|
|
- Configuration Modification
|
|
- Application Log Content
|
|
source: kubernetes
|
|
sourcetype: _json
|
|
supported_TA: []
|
|
fields:
|
|
- _time
|
|
- annotations.authorization.k8s.io/decision
|
|
- annotations.authorization.k8s.io/reason
|
|
- apiVersion
|
|
- auditID
|
|
- eventtype
|
|
- host
|
|
- index
|
|
- kind
|
|
- level
|
|
- linecount
|
|
- objectRef.apiGroup
|
|
- objectRef.apiVersion
|
|
- objectRef.namespace
|
|
- objectRef.resource
|
|
- punct
|
|
- requestReceivedTimestamp
|
|
- requestURI
|
|
- responseObject.apiVersion
|
|
- responseObject.code
|
|
- responseObject.details.group
|
|
- responseObject.details.kind
|
|
- responseObject.kind
|
|
- responseObject.message
|
|
- responseObject.reason
|
|
- responseObject.status
|
|
- responseStatus.code
|
|
- responseStatus.details.group
|
|
- responseStatus.details.kind
|
|
- responseStatus.message
|
|
- responseStatus.reason
|
|
- responseStatus.status
|
|
- source
|
|
- sourceIPs{}
|
|
- sourcetype
|
|
- splunk_server
|
|
- stage
|
|
- stageTimestamp
|
|
- tag
|
|
- tag::eventtype
|
|
- timestamp
|
|
- user.groups{}
|
|
- user.uid
|
|
- user.username
|
|
- userAgent
|
|
- verb
|
|
example_log: '{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"RequestResponse","auditID":"582c31ab-4906-49bb-9ff9-872f980ccb84","stage":"ResponseComplete","requestURI":"/apis/batch/v1/namespaces/test2/jobs?fieldManager=kubectl-create\u0026fieldValidation=Strict","verb":"create","user":{"username":"k8s-test-user","uid":"aws-iam-authenticator:111111111111:AROAYTXXXXXXHNXXXXX","groups":["system:authenticated"]},"sourceIPs":["176.95.188.101"],"userAgent":"kubectl/v1.27.2
|
|
(darwin/arm64) kubernetes/7f6f68f","objectRef":{"resource":"jobs","namespace":"test2","apiGroup":"batch","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"jobs.batch
|
|
is forbidden: User \"k8s-test-user\" cannot create resource \"jobs\" in API group
|
|
\"batch\" in the namespace \"test2\"","reason":"Forbidden","details":{"group":"batch","kind":"jobs"},"code":403},"responseObject":{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"jobs.batch
|
|
is forbidden: User \"k8s-test-user\" cannot create resource \"jobs\" in API group
|
|
\"batch\" in the namespace \"test2\"","reason":"Forbidden","details":{"group":"batch","kind":"jobs"},"code":403},"requestReceivedTimestamp":"2023-12-07T14:44:53.358394Z","stageTimestamp":"2023-12-07T14:44:53.375985Z","annotations":{"authorization.k8s.io/decision":"forbid","authorization.k8s.io/reason":""}}'
|