Navigation :
Kubernetes Azure Detect Most Active Service Accounts By Pod Namespace
Description
This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb
Help |
---|
Kubernetes Azure Detect Most Active Service Accounts By Pod Namespace HelpYou must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics |
Search |
---|
`kubernetes_azure` category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts* OR user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow | table sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace | top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace |`kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter` Open in Search |