Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. technique: T1613 ✕

Download CSV Show ATT&CK heatmap
  • A Kubernetes service account has enumerated its permissions Informational Cloud 2 variations

    A Kubernetes service account has enumerated its permissions using the self subject review API.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    3 Days
    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Container and Resource Discovery (T1613)
    Required data: AWS Audit Log Azure Audit Log Gcp Audit Log Kubernetes Audit Logs
    Detector tags: Kubernetes - API
    Attacker's goals: Discover permissions to the Kubernetes cluster.
    Investigative actions: Determine the scope of the Kubernetes service account permissions. Review additional activity of the Kubernetes service account.

    Variations

    Suspicious permission enumeration by a Kubernetes service account

    Low overridden

    A Kubernetes service account has enumerated its permissions using the self subject review API. overridden

    A Kubernetes service account attempted to enumerate its permissions

    Low overridden

    A Kubernetes service account has attempted to enumerate its permissions using the self subject review API. overridden