Detection rules › By event

Kubernetes-nodes

Event	Rules
get-nodes	2
list-nodes	2
watch-nodes	1
create-nodes	3
update-nodes	1
patch-nodes	1
get-nodes-proxy	4
create-nodes-proxy	4
update-nodes-proxy	3
patch-nodes-proxy	3
delete-nodes-proxy	3
any-nodes	2

get-nodes

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613

list-nodes

2 detection rules reference this event. View event page.

Elastic (2)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Multi-Resource Discovery severity medium T1613

watch-nodes

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

create-nodes

3 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

Falco (2)

Untrusted Node Successfully Joined the Cluster severity ERROR
Untrusted Node Unsuccessfully Tried to Join the Cluster severity WARNING

update-nodes

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

patch-nodes

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

get-nodes-proxy

4 detection rules reference this event. View event page.

Elastic (4)

Azure AKS API Server Proxying Request to Kubelet severity medium T1210, T1609
Azure AKS Kubelet Proxy to Command Execution Endpoint severity high T1210, T1609
GKE API Server Proxying Request to Kubelet severity medium T1550, T1550.001, T1611, T1613
Kubernetes API Server Proxying Request to Kubelet severity medium T1550, T1550.001, T1611, T1613

create-nodes-proxy

4 detection rules reference this event. View event page.

Elastic (4)

Azure AKS API Server Proxying Request to Kubelet severity medium T1210, T1609
Azure AKS Kubelet Proxy to Command Execution Endpoint severity high T1210, T1609
GKE API Server Proxying Request to Kubelet severity medium T1550, T1550.001, T1611, T1613
Kubernetes API Server Proxying Request to Kubelet severity medium T1550, T1550.001, T1611, T1613

update-nodes-proxy

3 detection rules reference this event. View event page.

Elastic (3)

Azure AKS API Server Proxying Request to Kubelet severity medium T1210, T1609
Azure AKS Kubelet Proxy to Command Execution Endpoint severity high T1210, T1609
Kubernetes API Server Proxying Request to Kubelet severity medium T1550, T1550.001, T1611, T1613

patch-nodes-proxy

3 detection rules reference this event. View event page.

Elastic (3)

Azure AKS API Server Proxying Request to Kubelet severity medium T1210, T1609
Azure AKS Kubelet Proxy to Command Execution Endpoint severity high T1210, T1609
Kubernetes API Server Proxying Request to Kubelet severity medium T1550, T1550.001, T1611, T1613

delete-nodes-proxy

3 detection rules reference this event. View event page.

Elastic (3)

Azure AKS API Server Proxying Request to Kubelet severity medium T1210, T1609
Azure AKS Kubelet Proxy to Command Execution Endpoint severity high T1210, T1609
Kubernetes API Server Proxying Request to Kubelet severity medium T1550, T1550.001, T1611, T1613

any-nodes

2 detection rules reference this event. View event page.

Elastic (2)

Kubernetes Multi-Resource Discovery severity medium T1613
Kubernetes Unusual Decision by User Agent severity low T1078