Elastic low deprecated kql

Kubernetes Unusual Decision by User Agent

This rule detects unusual request responses in Kubernetes audit logs through the use of the "new_terms" rule type. In production environments, default API requests are typically made by system components or trusted users, who are expected to have a consistent user agent and allowed response annotations. By monitoring for anomalies in the username and response annotations, this rule helps identify potential unauthorized access or misconfigurations in the Kubernetes environment.

View Source

Detection Logic

data_stream.dataset:"kubernetes.audit_logs" and kubernetes.audit.stage:"ResponseComplete" and
user_agent.original:(* and not (*kubernetes/$Format)) and
not (
  user_agent.original:kubelet* and
  not kubernetes.audit.objectRef.resource:(pods or nodes or csinodes or csidrivers or configmaps or secrets or events or leases or runtimeclasses) and
  kubernetes.audit.verb:(get or list or watch or patch)
)

Field Validations

Loading…

Comments (0)

Loading comments...