Create NodePort Service

Severity: WARNING
Source: k8saudit

Detect an attempt to start a service with a NodePort service type

Telemetry coverage

Platform	Record / event type
Kubernetes	create-services: create services

Rules detecting the same action

These rules filter on the same operation.

GCP K8S Service Type NodePort Deployed (Panther)
GKE Exposed Service Created With Type NodePort (Elastic)
K8s Service Created (Falco)
Kubernetes Exposed Service Created With Type NodePort (Elastic)
Kubernetes Node Port Creation (Splunk)
Kubernetes NodePort Service Deployed (Panther)
Kubernetes Service with Type Node Port Deployed (Panther)
Kubernetes Service with Type Node Port Deployed (Panther)

Stages and Predicates

Stage 1: `falco_condition`

and
  not
    jevt.rawtime eq "0"
  objectRef.resource eq "services"
  requestObject.service.type eq "NodePort"
  stage eq "ResponseComplete"
  verb eq "create"

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`jevt.rawtime`	eq	`0`	`excludes:jevt.rawtime` `field:"jevt.rawtime" value:"0"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`objectRef.resource`	eq	`services`	`field:"objectRef.resource" kind:eq value:"services"`
`requestObject.service.type`	eq	`NodePort`	`field:"requestObject.service.type" kind:eq value:"NodePort"`
`stage`	in	`ResponseComplete`	`field:"stage" kind:in value:"ResponseComplete"`
`verb`	eq	`create`	`field:"verb" kind:eq value:"create"`