detection.wiki

Detection rules › Falco

Ingress Object without TLS Certificate Created

Severity
WARNING
Source
k8saudit

Detect any attempt to create an ingress without TLS certification.

Telemetry coverage

PlatformRecord / event type
Kubernetescreate-ingresses: create ingresses

Rules detecting the same action

These rules filter on the same operation.

Stages and Predicates

Stage 1: falco_condition

and
  jevt.rawtime is_not_null
  objectRef.resource eq "ingresses"
  requestObject.spec.tls is_null
  responseStatus.code starts_with "2"
  stage eq "ResponseComplete"
  verb eq "create"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
jevt.rawtimeis_not_null
  • (no value, null check)
field:"jevt.rawtime" kind:is_not_null
objectRef.resourceeq
  • ingresses
field:"objectRef.resource" kind:eq value:"ingresses"
requestObject.spec.tlsis_null
  • (no value, null check)
field:"requestObject.spec.tls" kind:is_null
responseStatus.codestarts_with
  • 2
field:"responseStatus.code" kind:starts_with value:"2"
stagein
  • ResponseComplete
field:"stage" kind:in value:"ResponseComplete"
verbeq
  • create
field:"verb" kind:eq value:"create"