Detection rules › By event

Kubernetes-namespaces

Event	Rules
get-namespaces	2
list-namespaces	2
watch-namespaces	1
create-namespaces	3
update-namespaces	1
patch-namespaces	1
delete-namespaces	1
any-namespaces	1

get-namespaces

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613

list-namespaces

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613

watch-namespaces

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

create-namespaces

3 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

Falco (2)

Create Disallowed Namespace severity WARNING
K8s Namespace Created severity INFO

update-namespaces

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

patch-namespaces

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

delete-namespaces

1 detection rules reference this event. View event page.

Falco (1)

K8s Namespace Deleted severity INFO

any-namespaces

1 detection rules reference this event. View event page.

Elastic (1)

Kubernetes Multi-Resource Discovery severity medium T1613