Telemetry coverage
| Platform | Record / event type |
|---|---|
| Kubernetes | create-services: create services |
Rules detecting the same action
These rules filter on the same operation.
- Create NodePort Service (Falco)
- GCP K8S Service Type NodePort Deployed (Panther)
- GKE Exposed Service Created With Type NodePort (Elastic)
- Kubernetes Exposed Service Created With Type NodePort (Elastic)
- Kubernetes Node Port Creation (Splunk)
- Kubernetes NodePort Service Deployed (Panther)
- Kubernetes Service with Type Node Port Deployed (Panther)
- Kubernetes Service with Type Node Port Deployed (Panther)
Stages and Predicates
Stage 1: falco_condition
and
jevt.rawtime is_not_null
objectRef.resource eq "services"
responseStatus.code starts_with "2"
stage eq "ResponseComplete"
verb eq "create"
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
jevt.rawtime | is_not_null | field:"jevt.rawtime" kind:is_not_null | |
objectRef.resource | eq |
| field:"objectRef.resource" kind:eq value:"services" |
responseStatus.code | starts_with |
| field:"responseStatus.code" kind:starts_with value:"2" |
stage | in |
| field:"stage" kind:in value:"ResponseComplete" |
verb | eq |
| field:"verb" kind:eq value:"create" |