Skip to content

[Rule Tuning] Sharpening Kubernetes Rules Indices #4822

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

[Rule Tuning] Sharpening Kubernetes Rules Indices #4822

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9224287
[Rule Tuning] Sharpening Kubernetes Rules Indices
Aegrah Jun 18, 2025
11bde0b
Merge branch 'main' into sharpen-audit-indices
Aegrah Jun 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions rules/integrations/kubernetes/discovery_denied_service_account_request.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2022/09/13"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/06/18"

[rule]
author = ["Elastic"]
Expand All @@ -19,7 +19,7 @@ false_positives = [
problem within the cluster. This behavior should be investigated further.
""",
]
index = ["logs-kubernetes.*"]
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Denied Service Account Request"
Expand Down
4 changes: 2 additions & 2 deletions rules/integrations/kubernetes/discovery_suspicious_self_subject_review.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2022/06/30"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/06/18"

[rule]
author = ["Elastic"]
Expand All @@ -19,7 +19,7 @@ false_positives = [
privileges of another token other than that of the compromised account.
""",
]
index = ["logs-kubernetes.*"]
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Suspicious Self-Subject Review"
Expand Down
4 changes: 2 additions & 2 deletions rules/integrations/kubernetes/execution_user_exec_to_pod.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2022/05/17"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/06/17"
updated_date = "2025/06/18"

[rule]
author = ["Elastic"]
Expand All @@ -22,7 +22,7 @@ false_positives = [
connected to the terminal: kubectl exec -i -t cassandra -- sh
""",
]
index = ["logs-kubernetes.*"]
index = ["logs-kubernetes.audit_logs-*"]
language = "eql"
license = "Elastic License v2"
name = "Kubernetes User Exec into Pod"
Expand Down
4 changes: 2 additions & 2 deletions rules/integrations/kubernetes/initial_access_anonymous_request_authorized.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2022/09/13"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/06/18"

[rule]
author = ["Elastic"]
Expand All @@ -18,7 +18,7 @@ false_positives = [
investigated.
""",
]
index = ["logs-kubernetes.*"]
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Anonymous Request Authorized"
Expand Down
4 changes: 2 additions & 2 deletions rules/integrations/kubernetes/persistence_exposed_service_created_with_type_nodeport.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2022/07/05"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/06/18"

[rule]
author = ["Elastic"]
Expand All @@ -25,7 +25,7 @@ false_positives = [
expose one or more node's IPs directly.
""",
]
index = ["logs-kubernetes.*"]
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Exposed Service Created With Type NodePort"
Expand Down
4 changes: 2 additions & 2 deletions .../kubernetes/privilege_escalation_container_created_with_excessive_linux_capabilities.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2022/09/20"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/06/18"

[rule]
author = ["Elastic"]
Expand All @@ -19,7 +19,7 @@ false_positives = [
kubernetes.audit.requestObject.spec.containers.image.
""",
]
index = ["logs-kubernetes.*"]
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Container Created with Excessive Linux Capabilities"
Expand Down
4 changes: 2 additions & 2 deletions rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostipc.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2022/07/05"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/06/18"

[rule]
author = ["Elastic"]
Expand All @@ -22,7 +22,7 @@ false_positives = [
"kubernetes.audit.requestObject.spec.container.image"
""",
]
index = ["logs-kubernetes.*"]
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Pod Created With HostIPC"
Expand Down
4 changes: 2 additions & 2 deletions rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostnetwork.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2022/07/05"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/06/18"

[rule]
author = ["Elastic"]
Expand All @@ -21,7 +21,7 @@ false_positives = [
"kubernetes.audit.requestObject.spec.container.image"
""",
]
index = ["logs-kubernetes.*"]
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Pod Created With HostNetwork"
Expand Down
4 changes: 2 additions & 2 deletions rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostpid.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2022/07/05"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/06/18"

[rule]
author = ["Elastic"]
Expand All @@ -22,7 +22,7 @@ false_positives = [
"kubernetes.audit.requestObject.spec.container.image"
""",
]
index = ["logs-kubernetes.*"]
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Pod Created With HostPID"
Expand Down
4 changes: 2 additions & 2 deletions ...egrations/kubernetes/privilege_escalation_pod_created_with_sensitive_hostpath_volume.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2022/07/11"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/06/18"

[rule]
author = ["Elastic"]
Expand All @@ -22,7 +22,7 @@ false_positives = [
"kubernetes.audit.requestObject.spec.container.image"
""",
]
index = ["logs-kubernetes.*"]
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Pod created with a Sensitive hostPath Volume"
Expand Down
4 changes: 2 additions & 2 deletions rules/integrations/kubernetes/privilege_escalation_privileged_pod_created.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2022/07/05"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/06/18"

[rule]
author = ["Elastic"]
Expand All @@ -22,7 +22,7 @@ false_positives = [
trusted container images using the query field "kubernetes.audit.requestObject.spec.container.image"
""",
]
index = ["logs-kubernetes.*"]
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Privileged Pod Created"
Expand Down
4 changes: 2 additions & 2 deletions .../kubernetes/privilege_escalation_suspicious_assignment_of_controller_service_account.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2022/09/13"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/06/18"

[rule]
author = ["Elastic"]
Expand All @@ -20,7 +20,7 @@ false_positives = [
legitimate use-cases and should result in very few false positives.
""",
]
index = ["logs-kubernetes.*"]
index = ["logs-kubernetes.audit_logs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Kubernetes Suspicious Assignment of Controller Service Account"
Expand Down
Loading