Ingresses

Operation	Description	Sample	Rule
get-ingresses		Y	N
list-ingresses		Y	N
watch-ingresses		Y	N
create-ingresses	Ingress created (external exposure of cluster services; potential C2 or data exfiltration channel).	Y	Y
update-ingresses		Y	N
patch-ingresses		Y	N
delete-ingresses		Y	N
deletecollection-ingresses		Y	N
get-ingresses-status		Y	N
update-ingresses-status		Y	N
patch-ingresses-status		Y	N
any-ingresses	Synthetic aggregation for rules that filter the ingresses resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.	N	N

get ingresses

Resource: ingresses

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/networking.k8s.io/v1/namespaces/dw-harn/ingresses/dw-harn-ingresses",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "ingresses",
    "namespace": "dw-harn",
    "name": "dw-harn-ingresses",
    "apiGroup": "networking.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:47:53.498176Z",
  "stageTimestamp": "2026-07-02T04:47:53.499526Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

list ingresses

Resource: ingresses

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/networking.k8s.io/v1/namespaces/dw-harn/ingresses?limit=500&timeout=3s",
  "verb": "list",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "ingresses",
    "namespace": "dw-harn",
    "apiGroup": "networking.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:47:53.620810Z",
  "stageTimestamp": "2026-07-02T04:47:53.622431Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

watch ingresses

Resource: ingresses

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/networking.k8s.io/v1/namespaces/dw-harn/ingresses?resourceVersion=1624&timeout=3s&watch=true",
  "verb": "watch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "ingresses",
    "namespace": "dw-harn",
    "apiGroup": "networking.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:47:53.623582Z",
  "stageTimestamp": "2026-07-02T04:47:56.624704Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

create ingresses

Resource: ingresses

Description

Ingress created (external exposure of cluster services; potential C2 or data exfiltration channel).

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/networking.k8s.io/v1/namespaces/dw-harn/ingresses?fieldManager=kubectl-create&fieldValidation=Strict",
  "verb": "create",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "ingresses",
    "namespace": "dw-harn",
    "name": "dw-harn-ingresses",
    "apiGroup": "networking.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 201
  },
  "requestObject": {
    "kind": "Ingress",
    "apiVersion": "networking.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-ingresses",
      "namespace": "dw-harn"
    },
    "spec": {
      "rules": [
        {
          "http": {
            "paths": [
              {
                "path": "/",
                "pathType": "Prefix",
                "backend": {
                  "service": {
                    "name": "dw-harn-services",
                    "port": {
                      "number": 80
                    }
                  }
                }
              }
            ]
          }
        }
      ]
    },
    "status": {
      "loadBalancer": {}
    }
  },
  "responseObject": {
    "kind": "Ingress",
    "apiVersion": "networking.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-ingresses",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1624",
      "generation": 1,
      "creationTimestamp": "2026-07-02T04:47:53Z"
    },
    "spec": {
      "rules": [
        {
          "http": {
            "paths": [
              {
                "path": "/",
                "pathType": "Prefix",
                "backend": {
                  "service": {
                    "name": "dw-harn-services",
                    "port": {
                      "number": 80
                    }
                  }
                }
              }
            ]
          }
        }
      ]
    },
    "status": {
      "loadBalancer": {}
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:47:53.434544Z",
  "stageTimestamp": "2026-07-02T04:47:53.438248Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`requestObject.spec.tls`	is_null		2 rules	falco, panther
`jevt.rawtime` (falco rule field)	is_not_null		1 rule	falco
`responseStatus.code` (falco rule field)	starts_with	`2`	1 rule	falco

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Kubernetes Ingress Created Without TLS source medium: This detection monitors for Ingress objects being created without TLS certificates configured. Ingresses without TLS expose services over unencrypted HTTP, allowing sensitive data like passwords, tokens, and PII to be transmitted in cleartext. This violates security best practices and compliance requirements like PCI-DSS and HIPAA, and enables man-in-the-middle attacks.T1040, T1552.004

Falco #

Ingress Object without TLS Certificate Created source WARNING: Detect any attempt to create an ingress without TLS certification.

References #

Sample log: detection.wiki first-party kind capture

update ingresses

Resource: ingresses

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/networking.k8s.io/v1/namespaces/dw-harn/ingresses/dw-harn-ingresses?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "ingresses",
    "namespace": "dw-harn",
    "name": "dw-harn-ingresses",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "networking.k8s.io",
    "apiVersion": "v1",
    "resourceVersion": "787"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "Ingress",
    "apiVersion": "networking.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-ingresses",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "787",
      "generation": 1,
      "creationTimestamp": "2026-07-02T21:31:21Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "rules": [
        {
          "http": {
            "paths": [
              {
                "path": "/",
                "pathType": "Prefix",
                "backend": {
                  "service": {
                    "name": "dw-harn-services",
                    "port": {
                      "number": 80
                    }
                  }
                }
              }
            ]
          }
        }
      ]
    },
    "status": {
      "loadBalancer": {}
    }
  },
  "responseObject": {
    "kind": "Ingress",
    "apiVersion": "networking.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-ingresses",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "787",
      "generation": 1,
      "creationTimestamp": "2026-07-02T21:31:21Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "rules": [
        {
          "http": {
            "paths": [
              {
                "path": "/",
                "pathType": "Prefix",
                "backend": {
                  "service": {
                    "name": "dw-harn-services",
                    "port": {
                      "number": 80
                    }
                  }
                }
              }
            ]
          }
        }
      ]
    },
    "status": {
      "loadBalancer": {}
    }
  },
  "requestReceivedTimestamp": "2026-07-02T21:31:24.903410Z",
  "stageTimestamp": "2026-07-02T21:31:24.905867Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

patch ingresses

Resource: ingresses

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/networking.k8s.io/v1/namespaces/dw-harn/ingresses/dw-harn-ingresses?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "ingresses",
    "namespace": "dw-harn",
    "name": "dw-harn-ingresses",
    "apiGroup": "networking.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "metadata": {
      "labels": {
        "dw-harn-patched": "1"
      }
    }
  },
  "responseObject": {
    "kind": "Ingress",
    "apiVersion": "networking.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-ingresses",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1630",
      "generation": 1,
      "creationTimestamp": "2026-07-02T04:47:53Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "rules": [
        {
          "http": {
            "paths": [
              {
                "path": "/",
                "pathType": "Prefix",
                "backend": {
                  "service": {
                    "name": "dw-harn-services",
                    "port": {
                      "number": 80
                    }
                  }
                }
              }
            ]
          }
        }
      ]
    },
    "status": {
      "loadBalancer": {}
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:47:56.706547Z",
  "stageTimestamp": "2026-07-02T04:47:56.711479Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

delete ingresses

Resource: ingresses

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/networking.k8s.io/v1/namespaces/dw-harn/ingresses/dw-harn-ingresses",
  "verb": "delete",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "ingresses",
    "namespace": "dw-harn",
    "name": "dw-harn-ingresses",
    "apiGroup": "networking.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-ingresses",
      "group": "networking.k8s.io",
      "kind": "ingresses",
      "uid": "00000000-0000-0000-0000-000000000000"
    },
    "code": 200
  },
  "requestObject": {
    "kind": "DeleteOptions",
    "apiVersion": "meta.k8s.io/__internal",
    "propagationPolicy": "Background"
  },
  "responseObject": {
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-ingresses",
      "group": "networking.k8s.io",
      "kind": "ingresses",
      "uid": "00000000-0000-0000-0000-000000000000"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:47:56.783269Z",
  "stageTimestamp": "2026-07-02T04:47:56.787061Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

deletecollection ingresses

Resource: ingresses

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/networking.k8s.io/v1/namespaces/dw-harn/ingresses?labelSelector=dw-harn-patched",
  "verb": "deletecollection",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=3ffde68ef687218e01296d94b0aa59c81cc98de2bd73ab70e21510c8cd4b9cec"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "ingresses",
    "namespace": "dw-harn",
    "apiGroup": "networking.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "responseObject": {
    "kind": "IngressList",
    "apiVersion": "networking.k8s.io/v1",
    "metadata": {
      "resourceVersion": "926"
    },
    "items": [
      {
        "metadata": {
          "name": "dw-harn-ingresses",
          "namespace": "dw-harn",
          "uid": "00000000-0000-0000-0000-000000000000",
          "resourceVersion": "924",
          "generation": 1,
          "creationTimestamp": "2026-07-02T23:13:24Z",
          "labels": {
            "dw-harn-patched": "1"
          }
        },
        "spec": {
          "rules": [
            {
              "http": {
                "paths": [
                  {
                    "path": "/",
                    "pathType": "Prefix",
                    "backend": {
                      "service": {
                        "name": "dw-harn-services",
                        "port": {
                          "number": 80
                        }
                      }
                    }
                  }
                ]
              }
            }
          ]
        },
        "status": {
          "loadBalancer": {}
        }
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T23:13:27.785367Z",
  "stageTimestamp": "2026-07-02T23:13:27.790066Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

get ingresses/status

Resource: ingresses

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/networking.k8s.io/v1/namespaces/dw-harn/ingresses/dw-harn-ingresses/status",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "ingresses",
    "namespace": "dw-harn",
    "name": "dw-harn-ingresses",
    "apiGroup": "networking.k8s.io",
    "apiVersion": "v1",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T21:31:24.971296Z",
  "stageTimestamp": "2026-07-02T21:31:24.972897Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

update ingresses/status

Resource: ingresses

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/networking.k8s.io/v1/namespaces/dw-harn/ingresses/dw-harn-ingresses/status?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "ingresses",
    "namespace": "dw-harn",
    "name": "dw-harn-ingresses",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "networking.k8s.io",
    "apiVersion": "v1",
    "resourceVersion": "787",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "Ingress",
    "apiVersion": "networking.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-ingresses",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "787",
      "generation": 1,
      "creationTimestamp": "2026-07-02T21:31:21Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "rules": [
        {
          "http": {
            "paths": [
              {
                "path": "/",
                "pathType": "Prefix",
                "backend": {
                  "service": {
                    "name": "dw-harn-services",
                    "port": {
                      "number": 80
                    }
                  }
                }
              }
            ]
          }
        }
      ]
    },
    "status": {
      "loadBalancer": {}
    }
  },
  "responseObject": {
    "kind": "Ingress",
    "apiVersion": "networking.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-ingresses",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "787",
      "generation": 1,
      "creationTimestamp": "2026-07-02T21:31:21Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "rules": [
        {
          "http": {
            "paths": [
              {
                "path": "/",
                "pathType": "Prefix",
                "backend": {
                  "service": {
                    "name": "dw-harn-services",
                    "port": {
                      "number": 80
                    }
                  }
                }
              }
            ]
          }
        }
      ]
    },
    "status": {
      "loadBalancer": {}
    }
  },
  "requestReceivedTimestamp": "2026-07-02T21:31:25.053905Z",
  "stageTimestamp": "2026-07-02T21:31:25.056471Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

patch ingresses/status

Resource: ingresses

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/networking.k8s.io/v1/namespaces/dw-harn/ingresses/dw-harn-ingresses/status?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=786fc563dbb253683c44d23d0aac3742ea61ade7f27a43f50934a82662e15409"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "ingresses",
    "namespace": "dw-harn",
    "name": "dw-harn-ingresses",
    "apiGroup": "networking.k8s.io",
    "apiVersion": "v1",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {},
  "responseObject": {
    "kind": "Ingress",
    "apiVersion": "networking.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-ingresses",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "828",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:18:04Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "rules": [
        {
          "http": {
            "paths": [
              {
                "path": "/",
                "pathType": "Prefix",
                "backend": {
                  "service": {
                    "name": "dw-harn-services",
                    "port": {
                      "number": 80
                    }
                  }
                }
              }
            ]
          }
        }
      ]
    },
    "status": {
      "loadBalancer": {}
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:18:08.002810Z",
  "stageTimestamp": "2026-07-02T22:18:08.005016Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

any verb on ingresses (synthetic aggregation)

Resource: ingresses

Description

Synthetic aggregation for rules that filter the ingresses resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.