detection.wiki

Detection rules › Falco

K8s Deployment Deleted

Severity
INFO
Source
k8saudit

Detect any attempt to delete a deployment

Telemetry coverage

PlatformRecord / event type
Kubernetesdelete-deployments: delete deployments

Rules detecting the same action

These rules filter on the same operation.

Stages and Predicates

Stage 1: falco_condition

and
  jevt.rawtime is_not_null
  objectRef.resource eq "deployments"
  responseStatus.code starts_with "2"
  stage eq "ResponseComplete"
  verb eq "delete"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
jevt.rawtimeis_not_null
  • (no value, null check)
field:"jevt.rawtime" kind:is_not_null
objectRef.resourceeq
  • deployments
field:"objectRef.resource" kind:eq value:"deployments"
responseStatus.codestarts_with
  • 2
field:"responseStatus.code" kind:starts_with value:"2"
stagein
  • ResponseComplete
field:"stage" kind:in value:"ResponseComplete"
verbeq
  • delete
field:"verb" kind:eq value:"delete"