VolumeAttachments

Operation	Description	Sample	Rule
get-volumeattachments		Y	N
list-volumeattachments		Y	N
watch-volumeattachments		Y	N
create-volumeattachments		Y	N
update-volumeattachments		Y	N
patch-volumeattachments		Y	N
delete-volumeattachments		Y	N
deletecollection-volumeattachments		Y	N
get-volumeattachments-status		Y	N
update-volumeattachments-status		Y	N
patch-volumeattachments-status		Y	N
any-volumeattachments	Synthetic aggregation for rules that filter the volumeattachments resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.	N	N

get volumeattachments

Resource: volumeattachments

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/volumeattachments/dw-harn-volumeattachments",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=2f9bb39ae9e6831406f8ad02206bf46e69b5760f7adffe5feb860da290b80a7e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "volumeattachments",
    "name": "dw-harn-volumeattachments",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-03T00:16:26.219674Z",
  "stageTimestamp": "2026-07-03T00:16:26.221701Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

list volumeattachments

Resource: volumeattachments

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/volumeattachments?limit=500&timeout=3s",
  "verb": "list",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=2f9bb39ae9e6831406f8ad02206bf46e69b5760f7adffe5feb860da290b80a7e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "volumeattachments",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-03T00:16:26.367590Z",
  "stageTimestamp": "2026-07-03T00:16:26.370056Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

watch volumeattachments

Resource: volumeattachments

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/volumeattachments?resourceVersion=1171&timeout=3s&watch=true",
  "verb": "watch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=2f9bb39ae9e6831406f8ad02206bf46e69b5760f7adffe5feb860da290b80a7e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "volumeattachments",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-03T00:16:26.371343Z",
  "stageTimestamp": "2026-07-03T00:16:29.381601Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

create volumeattachments

Resource: volumeattachments

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/volumeattachments?fieldManager=kubectl-create&fieldValidation=Strict",
  "verb": "create",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "volumeattachments",
    "name": "dw-harn-volumeattachments",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "status": "Failure",
    "message": "VolumeAttachment.storage.k8s.io \"dw-harn-volumeattachments\" is invalid: [spec.attacher: Invalid value: \"dw.example/none\": a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*'), spec.source.inlineVolumeSpec.capacity: Forbidden: may not be specified in the context of inline volumes, spec.source.inlineVolumeSpec.csi.driver: Invalid value: \"dw.example/none\": a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')]",
    "reason": "Invalid",
    "details": {
      "name": "dw-harn-volumeattachments",
      "group": "storage.k8s.io",
      "kind": "VolumeAttachment",
      "causes": [
        {
          "reason": "FieldValueInvalid",
          "message": "Invalid value: \"dw.example/none\": a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')",
          "field": "spec.attacher"
        },
        {
          "reason": "FieldValueForbidden",
          "message": "Forbidden: may not be specified in the context of inline volumes",
          "field": "spec.source.inlineVolumeSpec.capacity"
        },
        {
          "reason": "FieldValueInvalid",
          "message": "Invalid value: \"dw.example/none\": a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')",
          "field": "spec.source.inlineVolumeSpec.csi.driver"
        }
      ]
    },
    "code": 422
  },
  "requestObject": {
    "kind": "VolumeAttachment",
    "apiVersion": "storage.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-volumeattachments"
    },
    "spec": {
      "attacher": "dw.example/none",
      "source": {
        "inlineVolumeSpec": {
          "capacity": {
            "storage": "1Mi"
          },
          "csi": {
            "driver": "dw.example/none",
            "volumeHandle": "dw-harn"
          },
          "accessModes": [
            "ReadWriteOnce"
          ]
        }
      },
      "nodeName": "dw-harn-none"
    },
    "status": {
      "attached": false
    }
  },
  "responseObject": {
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Failure",
    "message": "VolumeAttachment.storage.k8s.io \"dw-harn-volumeattachments\" is invalid: [spec.attacher: Invalid value: \"dw.example/none\": a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*'), spec.source.inlineVolumeSpec.capacity: Forbidden: may not be specified in the context of inline volumes, spec.source.inlineVolumeSpec.csi.driver: Invalid value: \"dw.example/none\": a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')]",
    "reason": "Invalid",
    "details": {
      "name": "dw-harn-volumeattachments",
      "group": "storage.k8s.io",
      "kind": "VolumeAttachment",
      "causes": [
        {
          "reason": "FieldValueInvalid",
          "message": "Invalid value: \"dw.example/none\": a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')",
          "field": "spec.attacher"
        },
        {
          "reason": "FieldValueForbidden",
          "message": "Forbidden: may not be specified in the context of inline volumes",
          "field": "spec.source.inlineVolumeSpec.capacity"
        },
        {
          "reason": "FieldValueInvalid",
          "message": "Invalid value: \"dw.example/none\": a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')",
          "field": "spec.source.inlineVolumeSpec.csi.driver"
        }
      ]
    },
    "code": 422
  },
  "requestReceivedTimestamp": "2026-07-02T21:32:36.249398Z",
  "stageTimestamp": "2026-07-02T21:32:36.250944Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

update volumeattachments

Resource: volumeattachments

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/volumeattachments/dw-harn-volumeattachments?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=2f9bb39ae9e6831406f8ad02206bf46e69b5760f7adffe5feb860da290b80a7e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "volumeattachments",
    "name": "dw-harn-volumeattachments",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1",
    "resourceVersion": "1177"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "VolumeAttachment",
    "apiVersion": "storage.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-volumeattachments",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1177",
      "creationTimestamp": "2026-07-03T00:16:26Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "attacher": "dw-harn.example",
      "source": {
        "persistentVolumeName": "dw-harn-none-pv"
      },
      "nodeName": "dw-harn-none"
    },
    "status": {
      "attached": false
    }
  },
  "responseObject": {
    "kind": "VolumeAttachment",
    "apiVersion": "storage.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-volumeattachments",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1177",
      "creationTimestamp": "2026-07-03T00:16:26Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "attacher": "dw-harn.example",
      "source": {
        "persistentVolumeName": "dw-harn-none-pv"
      },
      "nodeName": "dw-harn-none"
    },
    "status": {
      "attached": false
    }
  },
  "requestReceivedTimestamp": "2026-07-03T00:16:29.609775Z",
  "stageTimestamp": "2026-07-03T00:16:29.612171Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

patch volumeattachments

Resource: volumeattachments

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/volumeattachments/dw-harn-volumeattachments?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=2f9bb39ae9e6831406f8ad02206bf46e69b5760f7adffe5feb860da290b80a7e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "volumeattachments",
    "name": "dw-harn-volumeattachments",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "metadata": {
      "labels": {
        "dw-harn-patched": "1"
      }
    }
  },
  "responseObject": {
    "kind": "VolumeAttachment",
    "apiVersion": "storage.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-volumeattachments",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1177",
      "creationTimestamp": "2026-07-03T00:16:26Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "attacher": "dw-harn.example",
      "source": {
        "persistentVolumeName": "dw-harn-none-pv"
      },
      "nodeName": "dw-harn-none"
    },
    "status": {
      "attached": false
    }
  },
  "requestReceivedTimestamp": "2026-07-03T00:16:29.451033Z",
  "stageTimestamp": "2026-07-03T00:16:29.454923Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

delete volumeattachments

Resource: volumeattachments

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/volumeattachments/dw-harn-volumeattachments",
  "verb": "delete",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=2f9bb39ae9e6831406f8ad02206bf46e69b5760f7adffe5feb860da290b80a7e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "volumeattachments",
    "name": "dw-harn-volumeattachments",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "status": "Failure",
    "message": "volumeattachments.storage.k8s.io \"dw-harn-volumeattachments\" not found",
    "reason": "NotFound",
    "details": {
      "name": "dw-harn-volumeattachments",
      "group": "storage.k8s.io",
      "kind": "volumeattachments"
    },
    "code": 404
  },
  "requestObject": {
    "kind": "DeleteOptions",
    "apiVersion": "meta.k8s.io/__internal",
    "propagationPolicy": "Background"
  },
  "responseObject": {
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Failure",
    "message": "volumeattachments.storage.k8s.io \"dw-harn-volumeattachments\" not found",
    "reason": "NotFound",
    "details": {
      "name": "dw-harn-volumeattachments",
      "group": "storage.k8s.io",
      "kind": "volumeattachments"
    },
    "code": 404
  },
  "requestReceivedTimestamp": "2026-07-03T00:16:29.968489Z",
  "stageTimestamp": "2026-07-03T00:16:29.970445Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

deletecollection volumeattachments

Resource: volumeattachments

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/volumeattachments?labelSelector=dw-harn-patched",
  "verb": "deletecollection",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=2f9bb39ae9e6831406f8ad02206bf46e69b5760f7adffe5feb860da290b80a7e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "volumeattachments",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "responseObject": {
    "kind": "VolumeAttachmentList",
    "apiVersion": "storage.k8s.io/v1",
    "metadata": {
      "resourceVersion": "1177"
    },
    "items": [
      {
        "metadata": {
          "name": "dw-harn-volumeattachments",
          "uid": "00000000-0000-0000-0000-000000000000",
          "resourceVersion": "1177",
          "creationTimestamp": "2026-07-03T00:16:26Z",
          "labels": {
            "dw-harn-patched": "1"
          }
        },
        "spec": {
          "attacher": "dw-harn.example",
          "source": {
            "persistentVolumeName": "dw-harn-none-pv"
          },
          "nodeName": "dw-harn-none"
        },
        "status": {
          "attached": false
        }
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-03T00:16:29.896431Z",
  "stageTimestamp": "2026-07-03T00:16:29.901362Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

get volumeattachments/status

Resource: volumeattachments

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/volumeattachments/dw-harn-volumeattachments/status",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=2f9bb39ae9e6831406f8ad02206bf46e69b5760f7adffe5feb860da290b80a7e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "volumeattachments",
    "name": "dw-harn-volumeattachments",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-03T00:16:29.678903Z",
  "stageTimestamp": "2026-07-03T00:16:29.680379Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

update volumeattachments/status

Resource: volumeattachments

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/volumeattachments/dw-harn-volumeattachments/status?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=2f9bb39ae9e6831406f8ad02206bf46e69b5760f7adffe5feb860da290b80a7e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "volumeattachments",
    "name": "dw-harn-volumeattachments",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1",
    "resourceVersion": "1177",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "VolumeAttachment",
    "apiVersion": "storage.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-volumeattachments",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1177",
      "creationTimestamp": "2026-07-03T00:16:26Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "attacher": "dw-harn.example",
      "source": {
        "persistentVolumeName": "dw-harn-none-pv"
      },
      "nodeName": "dw-harn-none"
    },
    "status": {
      "attached": false
    }
  },
  "responseObject": {
    "kind": "VolumeAttachment",
    "apiVersion": "storage.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-volumeattachments",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1177",
      "creationTimestamp": "2026-07-03T00:16:26Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "attacher": "dw-harn.example",
      "source": {
        "persistentVolumeName": "dw-harn-none-pv"
      },
      "nodeName": "dw-harn-none"
    },
    "status": {
      "attached": false
    }
  },
  "requestReceivedTimestamp": "2026-07-03T00:16:29.762586Z",
  "stageTimestamp": "2026-07-03T00:16:29.765091Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

patch volumeattachments/status

Resource: volumeattachments

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/storage.k8s.io/v1/volumeattachments/dw-harn-volumeattachments/status?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=2f9bb39ae9e6831406f8ad02206bf46e69b5760f7adffe5feb860da290b80a7e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "volumeattachments",
    "name": "dw-harn-volumeattachments",
    "apiGroup": "storage.k8s.io",
    "apiVersion": "v1",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {},
  "responseObject": {
    "kind": "VolumeAttachment",
    "apiVersion": "storage.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-volumeattachments",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1177",
      "creationTimestamp": "2026-07-03T00:16:26Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "attacher": "dw-harn.example",
      "source": {
        "persistentVolumeName": "dw-harn-none-pv"
      },
      "nodeName": "dw-harn-none"
    },
    "status": {
      "attached": false
    }
  },
  "requestReceivedTimestamp": "2026-07-03T00:16:29.834819Z",
  "stageTimestamp": "2026-07-03T00:16:29.836857Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

any verb on volumeattachments (synthetic aggregation)

Resource: volumeattachments

Description

Synthetic aggregation for rules that filter the volumeattachments resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.