CSINodes

OperationDescriptionSampleRule
get-csinodesReads a single CSINode, the per-node record of which storage drivers and volume limits that node supports. Elastic's new-terms user-agent rule covers this call.YN
list-csinodesLists CSINode records across the cluster, mapping per-node storage attachment capacity. Elastic's new-terms rule covers a first-seen client doing this.YN
watch-csinodesOpens a long-lived watch on CSINode changes. Elastic's new-terms user-agent rule alerts on a not-previously-seen identity watching per-node storage topology.YN
create-csinodesNN
update-csinodesNN
patch-csinodesModifies a node's advertised CSI driver limits or IDs. Elastic's new-terms rule flags an unexpected client changing per-node storage attachment topology.NN
delete-csinodesNN
deletecollection-csinodesNN
any-csinodesSynthetic aggregation for rules that filter the csinodes resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.NY

get csinodes

#
Resource
csinodes

Description

Reads a single CSINode, the per-node record of which storage drivers and volume limits that node supports. Elastic's new-terms user-agent rule covers this call.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/csinodes/node-control-plane",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=2f9bb39ae9e6831406f8ad02206bf46e69b5760f7adffe5feb860da290b80a7e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "csinodes",
    "name": "node-control-plane",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-03T00:18:03.375652Z",
  "stageTimestamp": "2026-07-03T00:18:03.377308Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

list csinodes

#
Resource
csinodes

Description

Lists CSINode records across the cluster, mapping per-node storage attachment capacity. Elastic's new-terms rule covers a first-seen client doing this.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/csinodes?limit=500",
  "verb": "list",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "csinodes",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:49:00.497786Z",
  "stageTimestamp": "2026-07-02T04:49:00.499375Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

watch csinodes

#
Resource
csinodes

Description

Opens a long-lived watch on CSINode changes. Elastic's new-terms user-agent rule alerts on a not-previously-seen identity watching per-node storage topology.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/csinodes?resourceVersion=1506&timeout=3s&watch=true",
  "verb": "watch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=2f9bb39ae9e6831406f8ad02206bf46e69b5760f7adffe5feb860da290b80a7e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "csinodes",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-03T00:18:03.448289Z",
  "stageTimestamp": "2026-07-03T00:18:06.456019Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

create csinodes

#
Resource
csinodes

update csinodes

#
Resource
csinodes

patch csinodes

#
Resource
csinodes

Description

Modifies a node's advertised CSI driver limits or IDs. Elastic's new-terms rule flags an unexpected client changing per-node storage attachment topology.

delete csinodes

#
Resource
csinodes

deletecollection csinodes

#
Resource
csinodes

any verb on csinodes (synthetic aggregation)

#
Resource
csinodes

Description

Synthetic aggregation for rules that filter the csinodes resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
kubernetes.audit.stage (elastic rule field)eqresponsecomplete1 ruleelastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Kubernetes Unusual Decision by User Agent source low: This rule detects unusual request responses in Kubernetes audit logs through the use of the "new_terms" rule type. In production environments, default API requests are typically made by system components or trusted users, who are expected to have a consistent user agent and allowed response annotations. By monitoring for anomalies in the username and response annotations, this rule helps identify potential unauthorized access or misconfigurations in the Kubernetes environment.T1078