kubernetes_sensitive_object_access_activity.yml

name: Kubernetes Sensitive Object Access Activity
id: c7d4dbf0-a171-4eaf-8444-4f40392e4f92
version: 1
date: '2020-05-20'
author: Rod Soto, Splunk
description: This story addresses detection and response of accounts acccesing Kubernetes
  cluster sensitive objects such as configmaps or secrets providing information on
  items such as user user, group. object, namespace and authorization reason.
narrative: Kubernetes is the most used container orchestration platform, this orchestration
  platform contains sensitive objects within its architecture, specifically configmaps
  and secrets, if accessed by an attacker can lead to further compromise. These searches
  allow operator to detect suspicious requests against Kubernetes sensitive objects.
references:
- https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html
tags:
  analytic_story: Kubernetes Sensitive Object Access Activity
  category:
  - Cloud Security
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  usecase: Security Monitoring