CustomResourceDefinition

Operation	Description	Sample	Rule
get-customresourcedefinitions		Y	N
list-customresourcedefinitions		Y	N
watch-customresourcedefinitions		Y	N
create-customresourcedefinitions		Y	N
update-customresourcedefinitions		Y	N
patch-customresourcedefinitions		Y	N
delete-customresourcedefinitions		Y	N
deletecollection-customresourcedefinitions		Y	N
get-customresourcedefinitions-status		Y	N
update-customresourcedefinitions-status		Y	N
patch-customresourcedefinitions-status		Y	N
any-customresourcedefinitions	Synthetic aggregation for rules that filter the customresourcedefinitions resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.	N	N

get customresourcedefinitions

Resource: customresourcedefinitions

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions/dwharns.dwharn.example",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=fd038e49e5a46840f8f58360c3f09257f92bccd0cadad3ad68fcfec20b99b52c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "customresourcedefinitions",
    "name": "dwharns.dwharn.example",
    "apiGroup": "apiextensions.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:13:57.854610Z",
  "stageTimestamp": "2026-07-02T22:13:57.856425Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

list customresourcedefinitions

Resource: customresourcedefinitions

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions?limit=500",
  "verb": "list",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "customresourcedefinitions",
    "apiGroup": "apiextensions.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:49:00.817911Z",
  "stageTimestamp": "2026-07-02T04:49:00.819685Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

watch customresourcedefinitions

Resource: customresourcedefinitions

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions?resourceVersion=1056&timeout=3s&watch=true",
  "verb": "watch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=fd038e49e5a46840f8f58360c3f09257f92bccd0cadad3ad68fcfec20b99b52c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "customresourcedefinitions",
    "apiGroup": "apiextensions.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:13:57.992624Z",
  "stageTimestamp": "2026-07-02T22:14:00.992878Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

create customresourcedefinitions

Resource: customresourcedefinitions

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions?fieldManager=kubectl-create&fieldValidation=Strict",
  "verb": "create",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=fd038e49e5a46840f8f58360c3f09257f92bccd0cadad3ad68fcfec20b99b52c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "customresourcedefinitions",
    "name": "dwharns.dwharn.example",
    "apiGroup": "apiextensions.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 201
  },
  "requestObject": {
    "kind": "CustomResourceDefinition",
    "apiVersion": "apiextensions.k8s.io/v1",
    "metadata": {
      "name": "dwharns.dwharn.example"
    },
    "spec": {
      "group": "dwharn.example",
      "names": {
        "plural": "dwharns",
        "singular": "dwharn",
        "kind": "DwHarn",
        "listKind": "DwHarnList"
      },
      "scope": "Namespaced",
      "versions": [
        {
          "name": "v1",
          "served": true,
          "storage": true,
          "schema": {
            "openAPIV3Schema": {
              "type": "object",
              "x-kubernetes-preserve-unknown-fields": true
            }
          }
        }
      ],
      "conversion": {
        "strategy": "None"
      }
    },
    "status": {
      "conditions": null,
      "acceptedNames": {
        "plural": "",
        "kind": ""
      },
      "storedVersions": [
        "v1"
      ]
    }
  },
  "responseObject": {
    "kind": "CustomResourceDefinition",
    "apiVersion": "apiextensions.k8s.io/v1",
    "metadata": {
      "name": "dwharns.dwharn.example",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1053",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:13:57Z"
    },
    "spec": {
      "group": "dwharn.example",
      "names": {
        "plural": "dwharns",
        "singular": "dwharn",
        "kind": "DwHarn",
        "listKind": "DwHarnList"
      },
      "scope": "Namespaced",
      "versions": [
        {
          "name": "v1",
          "served": true,
          "storage": true,
          "schema": {
            "openAPIV3Schema": {
              "type": "object",
              "x-kubernetes-preserve-unknown-fields": true
            }
          }
        }
      ],
      "conversion": {
        "strategy": "None"
      }
    },
    "status": {
      "conditions": null,
      "acceptedNames": {
        "plural": "",
        "kind": ""
      },
      "storedVersions": [
        "v1"
      ]
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:13:57.778387Z",
  "stageTimestamp": "2026-07-02T22:13:57.783891Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

update customresourcedefinitions

Resource: customresourcedefinitions

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions/dwharns.dwharn.example?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=fd038e49e5a46840f8f58360c3f09257f92bccd0cadad3ad68fcfec20b99b52c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "customresourcedefinitions",
    "name": "dwharns.dwharn.example",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "apiextensions.k8s.io",
    "apiVersion": "v1",
    "resourceVersion": "1062"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "CustomResourceDefinition",
    "apiVersion": "apiextensions.k8s.io/v1",
    "metadata": {
      "name": "dwharns.dwharn.example",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1062",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:13:57Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "group": "dwharn.example",
      "names": {
        "plural": "dwharns",
        "singular": "dwharn",
        "kind": "DwHarn",
        "listKind": "DwHarnList"
      },
      "scope": "Namespaced",
      "versions": [
        {
          "name": "v1",
          "served": true,
          "storage": true,
          "schema": {
            "openAPIV3Schema": {
              "type": "object",
              "x-kubernetes-preserve-unknown-fields": true
            }
          }
        }
      ],
      "conversion": {
        "strategy": "None"
      }
    },
    "status": {
      "conditions": [
        {
          "type": "NamesAccepted",
          "status": "True",
          "lastTransitionTime": "2026-07-02T22:13:57Z",
          "reason": "NoConflicts",
          "message": "no conflicts found"
        },
        {
          "type": "Established",
          "status": "True",
          "lastTransitionTime": "2026-07-02T22:13:57Z",
          "reason": "InitialNamesAccepted",
          "message": "the initial names have been accepted"
        }
      ],
      "acceptedNames": {
        "plural": "dwharns",
        "singular": "dwharn",
        "kind": "DwHarn",
        "listKind": "DwHarnList"
      },
      "storedVersions": [
        "v1"
      ]
    }
  },
  "responseObject": {
    "kind": "CustomResourceDefinition",
    "apiVersion": "apiextensions.k8s.io/v1",
    "metadata": {
      "name": "dwharns.dwharn.example",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1062",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:13:57Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "group": "dwharn.example",
      "names": {
        "plural": "dwharns",
        "singular": "dwharn",
        "kind": "DwHarn",
        "listKind": "DwHarnList"
      },
      "scope": "Namespaced",
      "versions": [
        {
          "name": "v1",
          "served": true,
          "storage": true,
          "schema": {
            "openAPIV3Schema": {
              "type": "object",
              "x-kubernetes-preserve-unknown-fields": true
            }
          }
        }
      ],
      "conversion": {
        "strategy": "None"
      }
    },
    "status": {
      "conditions": [
        {
          "type": "NamesAccepted",
          "status": "True",
          "lastTransitionTime": "2026-07-02T22:13:57Z",
          "reason": "NoConflicts",
          "message": "no conflicts found"
        },
        {
          "type": "Established",
          "status": "True",
          "lastTransitionTime": "2026-07-02T22:13:57Z",
          "reason": "InitialNamesAccepted",
          "message": "the initial names have been accepted"
        }
      ],
      "acceptedNames": {
        "plural": "dwharns",
        "singular": "dwharn",
        "kind": "DwHarn",
        "listKind": "DwHarnList"
      },
      "storedVersions": [
        "v1"
      ]
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:14:01.214214Z",
  "stageTimestamp": "2026-07-02T22:14:01.217829Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

patch customresourcedefinitions

Resource: customresourcedefinitions

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions/dwharns.dwharn.example?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=fd038e49e5a46840f8f58360c3f09257f92bccd0cadad3ad68fcfec20b99b52c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "customresourcedefinitions",
    "name": "dwharns.dwharn.example",
    "apiGroup": "apiextensions.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "metadata": {
      "labels": {
        "dw-harn-patched": "1"
      }
    }
  },
  "responseObject": {
    "kind": "CustomResourceDefinition",
    "apiVersion": "apiextensions.k8s.io/v1",
    "metadata": {
      "name": "dwharns.dwharn.example",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1062",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:13:57Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "group": "dwharn.example",
      "names": {
        "plural": "dwharns",
        "singular": "dwharn",
        "kind": "DwHarn",
        "listKind": "DwHarnList"
      },
      "scope": "Namespaced",
      "versions": [
        {
          "name": "v1",
          "served": true,
          "storage": true,
          "schema": {
            "openAPIV3Schema": {
              "type": "object",
              "x-kubernetes-preserve-unknown-fields": true
            }
          }
        }
      ],
      "conversion": {
        "strategy": "None"
      }
    },
    "status": {
      "conditions": [
        {
          "type": "NamesAccepted",
          "status": "True",
          "lastTransitionTime": "2026-07-02T22:13:57Z",
          "reason": "NoConflicts",
          "message": "no conflicts found"
        },
        {
          "type": "Established",
          "status": "True",
          "lastTransitionTime": "2026-07-02T22:13:57Z",
          "reason": "InitialNamesAccepted",
          "message": "the initial names have been accepted"
        }
      ],
      "acceptedNames": {
        "plural": "dwharns",
        "singular": "dwharn",
        "kind": "DwHarn",
        "listKind": "DwHarnList"
      },
      "storedVersions": [
        "v1"
      ]
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:14:01.063025Z",
  "stageTimestamp": "2026-07-02T22:14:01.068041Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

delete customresourcedefinitions

Resource: customresourcedefinitions

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions/dwharns.dwharn.example",
  "verb": "delete",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=fd038e49e5a46840f8f58360c3f09257f92bccd0cadad3ad68fcfec20b99b52c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "customresourcedefinitions",
    "name": "dwharns.dwharn.example",
    "apiGroup": "apiextensions.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "DeleteOptions",
    "apiVersion": "meta.k8s.io/__internal",
    "propagationPolicy": "Background"
  },
  "responseObject": {
    "kind": "CustomResourceDefinition",
    "apiVersion": "apiextensions.k8s.io/v1",
    "metadata": {
      "name": "dwharns.dwharn.example",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1063",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:13:57Z",
      "deletionTimestamp": "2026-07-02T22:14:01Z",
      "labels": {
        "dw-harn-patched": "1"
      },
      "finalizers": [
        "customresourcecleanup.apiextensions.k8s.io"
      ]
    },
    "spec": {
      "group": "dwharn.example",
      "names": {
        "plural": "dwharns",
        "singular": "dwharn",
        "kind": "DwHarn",
        "listKind": "DwHarnList"
      },
      "scope": "Namespaced",
      "versions": [
        {
          "name": "v1",
          "served": true,
          "storage": true,
          "schema": {
            "openAPIV3Schema": {
              "type": "object",
              "x-kubernetes-preserve-unknown-fields": true
            }
          }
        }
      ],
      "conversion": {
        "strategy": "None"
      }
    },
    "status": {
      "conditions": [
        {
          "type": "NamesAccepted",
          "status": "True",
          "lastTransitionTime": "2026-07-02T22:13:57Z",
          "reason": "NoConflicts",
          "message": "no conflicts found"
        },
        {
          "type": "Established",
          "status": "True",
          "lastTransitionTime": "2026-07-02T22:13:57Z",
          "reason": "InitialNamesAccepted",
          "message": "the initial names have been accepted"
        },
        {
          "type": "Terminating",
          "status": "True",
          "lastTransitionTime": "2026-07-02T22:14:01Z",
          "reason": "InstanceDeletionPending",
          "message": "CustomResourceDefinition marked for deletion; CustomResource deletion will begin soon"
        }
      ],
      "acceptedNames": {
        "plural": "dwharns",
        "singular": "dwharn",
        "kind": "DwHarn",
        "listKind": "DwHarnList"
      },
      "storedVersions": [
        "v1"
      ]
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:14:01.425578Z",
  "stageTimestamp": "2026-07-02T22:14:01.432434Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

deletecollection customresourcedefinitions

Resource: customresourcedefinitions

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions?labelSelector=dw-harn-patched",
  "verb": "deletecollection",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=3ffde68ef687218e01296d94b0aa59c81cc98de2bd73ab70e21510c8cd4b9cec"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "customresourcedefinitions",
    "apiGroup": "apiextensions.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "responseObject": {
    "kind": "CustomResourceDefinitionList",
    "apiVersion": "apiextensions.k8s.io/v1",
    "metadata": {
      "resourceVersion": "1300"
    },
    "items": [
      {
        "metadata": {
          "name": "dwharns.dwharn.example",
          "uid": "00000000-0000-0000-0000-000000000000",
          "resourceVersion": "1299",
          "generation": 1,
          "creationTimestamp": "2026-07-02T23:15:25Z",
          "labels": {
            "dw-harn-patched": "1"
          }
        },
        "spec": {
          "group": "dwharn.example",
          "names": {
            "plural": "dwharns",
            "singular": "dwharn",
            "kind": "DwHarn",
            "listKind": "DwHarnList"
          },
          "scope": "Namespaced",
          "versions": [
            {
              "name": "v1",
              "served": true,
              "storage": true,
              "schema": {
                "openAPIV3Schema": {
                  "type": "object",
                  "x-kubernetes-preserve-unknown-fields": true
                }
              }
            }
          ],
          "conversion": {
            "strategy": "None"
          }
        },
        "status": {
          "conditions": [
            {
              "type": "NamesAccepted",
              "status": "True",
              "lastTransitionTime": "2026-07-02T23:15:25Z",
              "reason": "NoConflicts",
              "message": "no conflicts found"
            },
            {
              "type": "Established",
              "status": "True",
              "lastTransitionTime": "2026-07-02T23:15:25Z",
              "reason": "InitialNamesAccepted",
              "message": "the initial names have been accepted"
            }
          ],
          "acceptedNames": {
            "plural": "dwharns",
            "singular": "dwharn",
            "kind": "DwHarn",
            "listKind": "DwHarnList"
          },
          "storedVersions": [
            "v1"
          ]
        }
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T23:15:28.950053Z",
  "stageTimestamp": "2026-07-02T23:15:28.954914Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

get customresourcedefinitions/status

Resource: customresourcedefinitions

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions/dwharns.dwharn.example/status",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=fd038e49e5a46840f8f58360c3f09257f92bccd0cadad3ad68fcfec20b99b52c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "customresourcedefinitions",
    "name": "dwharns.dwharn.example",
    "apiGroup": "apiextensions.k8s.io",
    "apiVersion": "v1",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:14:01.282590Z",
  "stageTimestamp": "2026-07-02T22:14:01.284315Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

update customresourcedefinitions/status

Resource: customresourcedefinitions

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions/dwharns.dwharn.example/status?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=fd038e49e5a46840f8f58360c3f09257f92bccd0cadad3ad68fcfec20b99b52c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "customresourcedefinitions",
    "name": "dwharns.dwharn.example",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "apiextensions.k8s.io",
    "apiVersion": "v1",
    "resourceVersion": "1062",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "CustomResourceDefinition",
    "apiVersion": "apiextensions.k8s.io/v1",
    "metadata": {
      "name": "dwharns.dwharn.example",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1062",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:13:57Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "group": "dwharn.example",
      "names": {
        "plural": "dwharns",
        "singular": "dwharn",
        "kind": "DwHarn",
        "listKind": "DwHarnList"
      },
      "scope": "Namespaced",
      "versions": [
        {
          "name": "v1",
          "served": true,
          "storage": true,
          "schema": {
            "openAPIV3Schema": {
              "type": "object",
              "x-kubernetes-preserve-unknown-fields": true
            }
          }
        }
      ],
      "conversion": {
        "strategy": "None"
      }
    },
    "status": {
      "conditions": [
        {
          "type": "NamesAccepted",
          "status": "True",
          "lastTransitionTime": "2026-07-02T22:13:57Z",
          "reason": "NoConflicts",
          "message": "no conflicts found"
        },
        {
          "type": "Established",
          "status": "True",
          "lastTransitionTime": "2026-07-02T22:13:57Z",
          "reason": "InitialNamesAccepted",
          "message": "the initial names have been accepted"
        }
      ],
      "acceptedNames": {
        "plural": "dwharns",
        "singular": "dwharn",
        "kind": "DwHarn",
        "listKind": "DwHarnList"
      },
      "storedVersions": [
        "v1"
      ]
    }
  },
  "responseObject": {
    "kind": "CustomResourceDefinition",
    "apiVersion": "apiextensions.k8s.io/v1",
    "metadata": {
      "name": "dwharns.dwharn.example",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1062",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:13:57Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "group": "dwharn.example",
      "names": {
        "plural": "dwharns",
        "singular": "dwharn",
        "kind": "DwHarn",
        "listKind": "DwHarnList"
      },
      "scope": "Namespaced",
      "versions": [
        {
          "name": "v1",
          "served": true,
          "storage": true,
          "schema": {
            "openAPIV3Schema": {
              "type": "object",
              "x-kubernetes-preserve-unknown-fields": true
            }
          }
        }
      ],
      "conversion": {
        "strategy": "None"
      }
    },
    "status": {
      "conditions": [
        {
          "type": "NamesAccepted",
          "status": "True",
          "lastTransitionTime": "2026-07-02T22:13:57Z",
          "reason": "NoConflicts",
          "message": "no conflicts found"
        },
        {
          "type": "Established",
          "status": "True",
          "lastTransitionTime": "2026-07-02T22:13:57Z",
          "reason": "InitialNamesAccepted",
          "message": "the initial names have been accepted"
        }
      ],
      "acceptedNames": {
        "plural": "dwharns",
        "singular": "dwharn",
        "kind": "DwHarn",
        "listKind": "DwHarnList"
      },
      "storedVersions": [
        "v1"
      ]
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:14:01.355155Z",
  "stageTimestamp": "2026-07-02T22:14:01.358452Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

patch customresourcedefinitions/status

Resource: customresourcedefinitions

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/apiextensions.k8s.io/v1/customresourcedefinitions/dwharns.dwharn.example/status?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=786fc563dbb253683c44d23d0aac3742ea61ade7f27a43f50934a82662e15409"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "customresourcedefinitions",
    "name": "dwharns.dwharn.example",
    "apiGroup": "apiextensions.k8s.io",
    "apiVersion": "v1",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {},
  "responseObject": {
    "kind": "CustomResourceDefinition",
    "apiVersion": "apiextensions.k8s.io/v1",
    "metadata": {
      "name": "dwharns.dwharn.example",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1053",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:19:27Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "group": "dwharn.example",
      "names": {
        "plural": "dwharns",
        "singular": "dwharn",
        "kind": "DwHarn",
        "listKind": "DwHarnList"
      },
      "scope": "Namespaced",
      "versions": [
        {
          "name": "v1",
          "served": true,
          "storage": true,
          "schema": {
            "openAPIV3Schema": {
              "type": "object",
              "x-kubernetes-preserve-unknown-fields": true
            }
          }
        }
      ],
      "conversion": {
        "strategy": "None"
      }
    },
    "status": {
      "conditions": [
        {
          "type": "NamesAccepted",
          "status": "True",
          "lastTransitionTime": "2026-07-02T22:19:27Z",
          "reason": "NoConflicts",
          "message": "no conflicts found"
        },
        {
          "type": "Established",
          "status": "True",
          "lastTransitionTime": "2026-07-02T22:19:27Z",
          "reason": "InitialNamesAccepted",
          "message": "the initial names have been accepted"
        }
      ],
      "acceptedNames": {
        "plural": "dwharns",
        "singular": "dwharn",
        "kind": "DwHarn",
        "listKind": "DwHarnList"
      },
      "storedVersions": [
        "v1"
      ]
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:19:31.595961Z",
  "stageTimestamp": "2026-07-02T22:19:31.599066Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

any verb on customresourcedefinitions (synthetic aggregation)

Resource: customresourcedefinitions

Description

Synthetic aggregation for rules that filter the customresourcedefinitions resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.