Kubernetes coverage

331 Kubernetes detection rules across 5 vendors covering 161 (resource, verb) pairs.

Attributed to a specific audit verb

203 rules that name a specific Kubernetes audit verb against a resource, mapped to that (resource, verb) catalog event.

certificatesigningrequests 13 rules, 3 verbs

create 7 rules

patch 2 rules

update 4 rules

clusterrolebindings 35 rules, 8 verbs

create 12 rules

delete 5 rules

list 2 rules

patch 6 rules

replace 1 rule

update 6 rules

watch 1 rule

clusterroles 48 rules, 7 verbs

create 16 rules

delete 5 rules

list 2 rules

patch 11 rules

update 11 rules

watch 1 rule

configmaps 32 rules, 7 verbs

create 5 rules

delete 6 rules

list 3 rules

patch 7 rules

update 7 rules

watch 1 rule

cronjobs 31 rules, 8 verbs

create 10 rules

delete 1 rule

patch 9 rules

replace 1 rule

update 7 rules

watch 1 rule

daemonsets 20 rules, 6 verbs

create 9 rules

patch 5 rules

update 3 rules

watch 1 rule

deployments 20 rules, 7 verbs

create 6 rules

delete 2 rules

patch 6 rules

update 3 rules

watch 1 rule

events 4 rules, 2 verbs

delete 3 rules

deletecollection 1 rule

ingresses 2 rules, 1 verb

create 2 rules

jobs 11 rules, 8 verbs

create 2 rules

delete 1 rule

patch 2 rules

replace 1 rule

update 2 rules

watch 1 rule

mutatingwebhookconfigurations 15 rules, 5 verbs

create 6 rules

delete 2 rules

patch 3 rules

replace 1 rule

update 3 rules

namespaces 11 rules, 7 verbs

create 3 rules

delete 1 rule

list 2 rules

patch 1 rule

update 1 rule

watch 1 rule

nodes 12 rules, 6 verbs

create 4 rules

list 2 rules

patch 1 rule

update 1 rule

watch 1 rule

pods 139 rules, 6 verbs

create 71 rules

get 12 rules

list 3 rules

patch 24 rules

update 28 rules

watch 1 rule

rolebindings 30 rules, 8 verbs

create 9 rules

delete 5 rules

list 2 rules

patch 5 rules

replace 1 rule

update 5 rules

watch 1 rule

roles 48 rules, 7 verbs

create 16 rules

delete 5 rules

list 2 rules

patch 11 rules

update 11 rules

watch 1 rule

secrets 56 rules, 8 verbs

create 5 rules

delete 4 rules

get 20 rules

list 14 rules

patch 4 rules

replace 1 rule

update 4 rules

watch 4 rules

selfsubjectaccessreviews 9 rules, 6 verbs

create 4 rules

patch 1 rule

update 1 rule

watch 1 rule

selfsubjectrulesreviews 10 rules, 6 verbs

create 5 rules

patch 1 rule

update 1 rule

watch 1 rule

serviceaccounts 16 rules, 7 verbs

create 8 rules

delete 1 rule

list 2 rules

patch 1 rule

update 1 rule

watch 1 rule

services 14 rules, 4 verbs

create 9 rules

delete 1 rule

patch 2 rules

update 2 rules

statefulsets 6 rules, 6 verbs

create 1 rule

patch 1 rule

update 1 rule

watch 1 rule

subjectaccessreviews 6 rules, 6 verbs

create 1 rule

patch 1 rule

update 1 rule

watch 1 rule

validatingwebhookconfiguration 2 rules, 1 verb

create 2 rules

validatingwebhookconfigurations 13 rules, 5 verbs

create 4 rules

delete 2 rules

patch 3 rules

replace 1 rule

update 3 rules

Attributed to a resource, not a specific verb

16 rules that name a Kubernetes resource but no single audit verb, mapped to that resource's catch-all event.

clusterrolebindings 1 rule, 1 verb

(any) 1 rule

clusterroles 1 rule, 1 verb

(any) 1 rule

configmaps 2 rules, 1 verb

(any) 2 rules

csidrivers 1 rule, 1 verb

(any) 1 rule

csinodes 1 rule, 1 verb

(any) 1 rule

events 1 rule, 1 verb

(any) 1 rule

leases 1 rule, 1 verb

(any) 1 rule

namespaces 1 rule, 1 verb

(any) 1 rule

nodes 5 rules, 1 verb

(any) 5 rules

pods 9 rules, 1 verb

(any) 9 rules

rolebindings 1 rule, 1 verb

(any) 1 rule

roles 1 rule, 1 verb

(any) 1 rule

runtimeclasses 1 rule, 1 verb

(any) 1 rule

secrets 5 rules, 1 verb

(any) 5 rules

serviceaccounts 1 rule, 1 verb

(any) 1 rule

Not attributed to a Kubernetes audit verb

112 rules that resolve to no Kubernetes resource.

(unattributed) 112 rules, 1 verb

(any) 112 rules