Skip to content

newgcpk8podsearch #568

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
patel-bhavin merged 3 commits into from
Jul 20, 2020
Merged

newgcpk8podsearch #568

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ef98461
newgcpk8podsearch
rosplk Jul 18, 2020
bb906c7
Update gcp_kubernetes_cluster_pod_scan_detection.yml
patel-bhavin Jul 20, 2020
2d9eaf6
Merge branch 'develop' into newgcpk8podsearch
patel-bhavin Jul 20, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions detections/gcp_kubernetes_cluster_pod_scan_detection.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
name: GCP Kubernetes cluster pod scan detection
id: 19b53215-4a16-405b-8087-9e6acf619842
version: 1
date: '2020-07-17'
description: This search provides information of unauthenticated requests via user
agent, and authentication data against Kubernetes cluster's pods
how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or later),
then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk.
type: ESCU
references: []
author: Rod Soto, Splunk
search: '`google_gcp_pubsub_message` category=kube-audit |spath input=properties.log |search responseStatus.code=401 |table sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod | `gcp_kubernetes_cluster_pod_scan_detection_filter`'
known_false_positives: Not all unauthenticated requests are malicious, but frequency, User Agent, source IPs and pods will provide context.
tags:
analytics_story:
- Kubernetes Scanning Activity
kill_chain_phases:
- Reconnaissance
mitre_attack_id:
- T1526
security_domain: threat
asset_type: GCP Kubernetes cluster