K8s Secret Get Unsuccessfully Tried

Severity: WARNING
Source: k8saudit

Detect an unsuccessful attempt to get the secret. Service account tokens are excluded.

Telemetry coverage

Platform	Record / event type
Kubernetes	get-secrets: get secrets

Rules detecting the same action

These rules filter on the same operation.

Azure AKS Secret get or list with Suspicious User Agent (Elastic)
Direct Interactive Kubernetes API Request by Unusual Utilities (Elastic)
GKE Rapid Secret GET Activity Against Multiple Objects (Elastic)
GKE Secret Access from Node or Denied Service Account (Elastic)
GKE Secret Access via Unusual User Agent (Elastic)
GKE Secret get or list with Suspicious User Agent (Elastic)
GKE Unusual Service Account Secret Access via New User Agent (Elastic)
K8s Secret Get Successfully (Falco)

Stages and Predicates

Stage 1: `falco_condition`

and
  not
    responseStatus.code starts_with "2"
  jevt.rawtime is_not_null
  objectRef.resource eq "secrets"
  stage eq "ResponseComplete"
  verb eq "get"

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`responseStatus.code`	starts_with	`2`	`excludes:responseStatus.code` `field:"responseStatus.code" value:"2"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`jevt.rawtime`	is_not_null	(no value, null check)	`field:"jevt.rawtime" kind:is_not_null`
`objectRef.resource`	eq	`secrets`	`field:"objectRef.resource" kind:eq value:"secrets"`
`stage`	in	`ResponseComplete`	`field:"stage" kind:in value:"ResponseComplete"`
`verb`	eq	`get`	`field:"verb" kind:eq value:"get"`