Kubernetes Secrets Modified or Deleted

{
  "selection": {
    "objectRef.resource": "secrets",
    "verb": [
      "create",
      "delete",
      "patch",
      "replace",
      "update"
    ]
  },
  "condition": "selection"
}

False Positives

• ⚠ Secrets being modified or deleted may be performed by a system administrator.
• ⚠ Automated processes may need to take these actions and may need to be filtered.