Anonymous request authorized
Set up the kubernetes integration.
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detect when an unauthenticated request user is permitted in Kubernetes.
Strategy
This rule monitors when any action is permitted (@http.status_code:[100 TO 299]) for an unauthenticated user (@user.username:\"system:anonymous\").
The /livez and /readyz endpoints are commonly accessed unauthenticated and are excluded in the query filter.
Triage and response
- Inspect all of the HTTP paths accessed and determine if any of the path should be permitted by unauthenticated users.
- Determine what IP addresses accessed Kubernetes endpoints which may contain sensitive data.
