Skip to content

Instantly share code, notes, and snippets.

@vicenteherrera

vicenteherrera/full_k8s_administrative_access.yaml

Created March 23, 2020 18:18
Show Gist options
  • Save vicenteherrera/7a052fc4ce5d7ab80f495a7596c8125f to your computer and use it in GitHub Desktop.
Save vicenteherrera/7a052fc4ce5d7ab80f495a7596c8125f to your computer and use it in GitHub Desktop.
Download ZIP
Raw
full_k8s_administrative_access.yaml
- rule: Full K8s Administrative Access
desc: Detect any k8s operation by an administrator with full access.
condition: >
kevt and non_system_user and ka.user.name in (admin_k8s_users) and not allowed_full_admin_users
output: K8s Operation performed by full admin user (user=%ka.user.name target=%ka.target.name/%ka.target.resource verb=%ka.verb uri=%ka.uri resp=%ka.response.code)
priority: WARNING
source: k8s_audit
tags: [k8s, NIST, NIST_3.1, PCI, PCI_DSS_2.1]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment