CSINodes
| Operation | Description | Sample | Rule |
|---|---|---|---|
| get-csinodes | Reads a single CSINode, the per-node record of which storage drivers and volume limits that node supports. Elastic's new-terms user-agent rule covers this call. | Y | N |
| list-csinodes | Lists CSINode records across the cluster, mapping per-node storage attachment capacity. Elastic's new-terms rule covers a first-seen client doing this. | Y | N |
| watch-csinodes | Opens a long-lived watch on CSINode changes. Elastic's new-terms user-agent rule alerts on a not-previously-seen identity watching per-node storage topology. | Y | N |
| create-csinodes | N | N | |
| update-csinodes | N | N | |
| patch-csinodes | Modifies a node's advertised CSI driver limits or IDs. Elastic's new-terms rule flags an unexpected client changing per-node storage attachment topology. | N | N |
| delete-csinodes | N | N | |
| deletecollection-csinodes | N | N | |
| any-csinodes | Synthetic aggregation for rules that filter the csinodes resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone. | N | Y |
get csinodes
#Description
Reads a single CSINode, the per-node record of which storage drivers and volume limits that node supports. Elastic's new-terms user-agent rule covers this call.
Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "Metadata",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/storage.k8s.io/v1/csinodes/node-control-plane",
"verb": "get",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=2f9bb39ae9e6831406f8ad02206bf46e69b5760f7adffe5feb860da290b80a7e"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "csinodes",
"name": "node-control-plane",
"apiGroup": "storage.k8s.io",
"apiVersion": "v1"
},
"responseStatus": {
"metadata": {},
"code": 200
},
"requestReceivedTimestamp": "2026-07-03T00:18:03.375652Z",
"stageTimestamp": "2026-07-03T00:18:03.377308Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
list csinodes
#Description
Lists CSINode records across the cluster, mapping per-node storage attachment capacity. Elastic's new-terms rule covers a first-seen client doing this.
Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "Metadata",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/storage.k8s.io/v1/csinodes?limit=500",
"verb": "list",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "csinodes",
"apiGroup": "storage.k8s.io",
"apiVersion": "v1"
},
"responseStatus": {
"metadata": {},
"code": 200
},
"requestReceivedTimestamp": "2026-07-02T04:49:00.497786Z",
"stageTimestamp": "2026-07-02T04:49:00.499375Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
watch csinodes
#Description
Opens a long-lived watch on CSINode changes. Elastic's new-terms user-agent rule alerts on a not-previously-seen identity watching per-node storage topology.
Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "Metadata",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/storage.k8s.io/v1/csinodes?resourceVersion=1506&timeout=3s&watch=true",
"verb": "watch",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=2f9bb39ae9e6831406f8ad02206bf46e69b5760f7adffe5feb860da290b80a7e"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "csinodes",
"apiGroup": "storage.k8s.io",
"apiVersion": "v1"
},
"responseStatus": {
"metadata": {},
"code": 200
},
"requestReceivedTimestamp": "2026-07-03T00:18:03.448289Z",
"stageTimestamp": "2026-07-03T00:18:06.456019Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
create csinodes
#update csinodes
#patch csinodes
#Description
Modifies a node's advertised CSI driver limits or IDs. Elastic's new-terms rule flags an unexpected client changing per-node storage attachment topology.
delete csinodes
#deletecollection csinodes
#any verb on csinodes (synthetic aggregation)
#Description
Synthetic aggregation for rules that filter the csinodes resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
kubernetes.audit.stage (elastic rule field) | eq | responsecomplete | 1 rule | elastic |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Elastic #
T1078