New Kubernetes Namespace Created

kubernetes

Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1578-modify-cloud-compute-infrastructure

Set up the kubernetes integration.

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect when a user is creating a Kubernetes namespace.

Strategy

This rule monitors when a create action occurs for the Kubernetes namespace (@objectRef.resource:namespaces) to detect when a user is creating a new Kubernetes namespace.

Triage and response

Determine if the user should be creating this new namespace.

Changelog

  • 7 May 2024 - Updated detection query to include logs from Azure Kubernetes Service.
  • 16 July 2024 - Updated detection query to include logs from Google Kubernetes Engine.