☰
Navigation :

Kubernetes Azure Detect Most Active Service Accounts By Pod Namespace

Description

This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb

Content Mapping

This content is not mapped to any local saved search. Add mapping


Use Case

Security Monitoring

Category

Adversary Tactics

Alert Volume

This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb

SPL Difficulty

None

Journey

Stage 3

Data Sources

Audit Trail
Azure

   Help

Kubernetes Azure Detect Most Active Service Accounts By Pod Namespace Help

You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics

   Search

`kubernetes_azure` category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts* OR user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow  | table  sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace | top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace |`kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter`
Open in Search