Kubernetes newly seen TCP edge
The following analytic identifies newly seen TCP communication between source and destination workload pairs within a Kubernetes cluster. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. The detection compares network activity over the last hour with the past 30 days to spot new inter-workload communications. This is significant as new connections can indicate changes in application behavior or potential security threats. If malicious, unauthorized connections could lead to data breaches, privilege escalation, lateral movement, or disruption of critical services, compromising the application's integrity, availability, and confidentiality.
Detection Logic
| mstats count(tcp.packets) as tcp.packets_count where `kubernetes_metrics`
AND earliest=-1h by k8s.cluster.name source.workload.name dest.workload.name
| eval current="True"
| append [ mstats count(tcp.packets) as tcp.packets_count where `kubernetes_metrics`
AND earliest=-30d latest=-1h by source.workload.name dest.workload.name
| eval current="false" ]
| eventstats values(current) as current
BY source.workload.name dest.workload.name
| search current="true" current!="false"
| rename k8s.cluster.name as host
| `kubernetes_newly_seen_tcp_edge_filter`False Positives
- ⚠ No false positives have been identified at this time.
Field Validations
Loading…
Comments (0)
Loading comments...