☰
Navigation :

Kubernetes GCP Detect Most Active Service Accounts By Pod

Description

This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision

   Help

Kubernetes GCP Detect Most Active Service Accounts By Pod Help

You must install splunk GCP add on. This search works with pubsub messaging service logs

   Search

`google_gcp_pubsub_message`  data.protoPayload.request.spec.group{}=system:serviceaccounts | table src_ip src_user http_user_agent data.protoPayload.request.spec.nonResourceAttributes.verb data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource | top src_ip src_user http_user_agent data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource |`kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter`
Open in Search