Kubernetes GCP detect sensitive object access

Name:Kubernetes GCP detect sensitive object access
id:bdb6d596-86a0-4aba-8369-418ae8b9963a
version:4
date:2024-11-14
author:Rod Soto, Splunk
status:deprecated
type:Hunting
Description:This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets
Data_source:

search:`google_gcp_pubsub_message` data.protoPayload.authorizationInfo{}.resource=configmaps OR secrets
| table data.protoPayload.requestMetadata.callerIp src_user data.resource.labels.cluster_name data.protoPayload.request.metadata.namespace data.labels.authorization.k8s.io/decision
| dedup data.protoPayload.requestMetadata.callerIp src_user data.resource.labels.cluster_name |`kubernetes_gcp_detect_sensitive_object_access_filter`

how_to_implement:You must install splunk add on for GCP . This search works with pubsub messaging service logs.
known_false_positives:Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection.
References:
drilldown_searches:
  :
analytic_story:['Kubernetes Sensitive Object Access Activity']

asset_type:GCP GKE Kubernetes cluster

mitre_attack_id:NULL

product:None

category:None

security_domain:threat

tags:
  analytic_story:
    - 'Kubernetes Sensitive Object Access Activity'
  asset_type:GCP GKE Kubernetes cluster
  product:
    - 'Splunk Enterprise'
    - 'Splunk Enterprise Security'
    - 'Splunk Cloud'
  security_domain:threat

tests:
  :
manual_test:None