Elastic high stable kql

AWS EKS Control Plane Logging Disabled

Detects successful Amazon EKS UpdateClusterConfig requests that disable control plane logging. Disabling EKS API server and control plane logs can reduce visibility into cluster activity and may indicate defense evasion following compromised AWS credentials or unauthorized administrative access. EKS control plane logging changes are typically rare and should align with approved maintenance or cost optimization workflows.

View Source

Detection Logic

data_stream.dataset:"aws.cloudtrail" and
event.provider:"eks.amazonaws.com" and
event.action:"UpdateClusterConfig" and
event.outcome:"success" and
aws.cloudtrail.request_parameters:*logging*enabled=false*

False Positives

⚠ Legitimate changes to EKS logging configuration during cluster provisioning, troubleshooting, or cost optimization may match. Validate the caller identity and change records, and baseline expected automation roles.

Field Validations

Loading…

Comments (0)

Loading comments...