Falco informational stable other
Contact cloud metadata service from container
Detects attempts to communicate with the Cloud Instance Metadata Service from a container. This detection is narrowly focused and might not apply to your environment. In addition, it could generate noise and require fine-tuning.
Detection Logic
outbound and container and fd.sip="169.254.169.254" and not user_known_metadata_accessField Validations
Loading…
Comments (0)
Loading comments...