detection.wiki

Detection rules › Falco

K8s Namespace Deleted

Severity
INFO
Source
k8saudit

Detect any attempt to delete a namespace

Telemetry coverage

PlatformRecord / event type
Kubernetesdelete-namespaces: delete namespaces

Stages and Predicates

Stage 1: falco_condition

and
  not
    user.username starts_with "system:"
  jevt.rawtime is_not_null
  objectRef.resource eq "namespaces"
  responseStatus.code starts_with "2"
  stage eq "ResponseComplete"
  verb eq "delete"

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
user.usernamestarts_withsystem:excludes:user.username field:"user.username" value:"system:"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
jevt.rawtimeis_not_null
  • (no value, null check)
field:"jevt.rawtime" kind:is_not_null
objectRef.resourceeq
  • namespaces
field:"objectRef.resource" kind:eq value:"namespaces"
responseStatus.codestarts_with
  • 2
field:"responseStatus.code" kind:starts_with value:"2"
stagein
  • ResponseComplete
field:"stage" kind:in value:"ResponseComplete"
verbeq
  • delete
field:"verb" kind:eq value:"delete"