Detection rules › By event

Kubernetes-deployments

Event	Rules
get-deployments	1
list-deployments	1
watch-deployments	1
create-deployments	6
update-deployments	1
patch-deployments	6
delete-deployments	2

get-deployments

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

list-deployments

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

watch-deployments

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

create-deployments

6 detection rules reference this event. View event page.

Elastic (5)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
GKE Unusual Sensitive Workload Modification severity low T1098, T1098.006
Kubernetes Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
Unusual Kubernetes Sensitive Workload Modification severity low T1098, T1098.006

Falco (1)

K8s Deployment Created severity INFO

update-deployments

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

patch-deployments

6 detection rules reference this event. View event page.

Sigma (1)

Potential Sidecar Injection Into Running Deployment severity medium T1609

Elastic (5)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
GKE Unusual Sensitive Workload Modification severity low T1098, T1098.006
Kubernetes Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
Unusual Kubernetes Sensitive Workload Modification severity low T1098, T1098.006

delete-deployments

2 detection rules reference this event. View event page.

Sigma (1)

Deployment Deleted From Kubernetes Cluster severity low T1498

Falco (1)

K8s Deployment Deleted severity INFO