Sensitive namespace modified using kubectl

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.


Detect the use of kubectl inside a container to modify the ConfigMap of a sensitive namespace.


This detection triggers when kubectl is executed with specific arguments related to modifying the ConfigMap of a sensitive namespace.

Triage and response

  1. Identify the purpose of the configuration being applied, and determine if it is authorized.
  2. If it is not authorized, identify and revoke the credential used to authenticate to the Kubernetes API.
  3. Initiate the incident response process.
  4. Remediate compromised resources and repair the root cause.

Requires Agent version 7.27 or greater