New Kubernetes privileged pod created
Set up the kubernetes integration.
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detect when a privileged pod is created. Privileged pods remove container isolation which allows privileged actions on the host.
Strategy
This rule monitors when a pod (@objectRef.resource:pods) is created (@http.method:create) and the privileged security context (@requestObject.spec.containers.securityContext.privileged) is true.
Triage & Response
Determine if the pod should be privileged.
Changelog
- 7 May 2024 - Updated detection query to include logs from Azure Kubernetes Service.
