Kubernetes coverage

280 Kubernetes detection rules across 4 vendors covering 153 (resource, verb) pairs.

Attributed to a specific audit verb

159 rules that name a specific Kubernetes audit verb against a resource, mapped to that (resource, verb) catalog event.

certificatesigningrequests 13 rules, 3 verbs

create 7 rules

patch 2 rules

update 4 rules

clusterrolebindings 32 rules, 8 verbs

create 10 rules

delete 4 rules

list 2 rules

patch 6 rules

replace 1 rule

update 6 rules

watch 1 rule

clusterroles 39 rules, 7 verbs

create 11 rules

delete 3 rules

list 2 rules

patch 10 rules

update 10 rules

watch 1 rule

configmaps 27 rules, 7 verbs

create 3 rules

delete 5 rules

list 3 rules

patch 6 rules

update 6 rules

watch 1 rule

cronjobs 31 rules, 8 verbs

create 10 rules

delete 1 rule

patch 9 rules

replace 1 rule

update 7 rules

watch 1 rule

daemonsets 20 rules, 6 verbs

create 9 rules

patch 5 rules

update 3 rules

watch 1 rule

deployments 18 rules, 7 verbs

create 5 rules

delete 1 rule

patch 6 rules

update 3 rules

watch 1 rule

events 4 rules, 2 verbs

delete 3 rules

deletecollection 1 rule

ingresses 1 rule, 1 verb

create 1 rule

jobs 11 rules, 8 verbs

create 2 rules

delete 1 rule

patch 2 rules

replace 1 rule

update 2 rules

watch 1 rule

mutatingwebhookconfigurations 15 rules, 5 verbs

create 6 rules

delete 2 rules

patch 3 rules

replace 1 rule

update 3 rules

namespaces 8 rules, 6 verbs

create 1 rule

list 2 rules

patch 1 rule

update 1 rule

watch 1 rule

nodes 10 rules, 6 verbs

create 2 rules

list 2 rules

patch 1 rule

update 1 rule

watch 1 rule

pods 127 rules, 6 verbs

create 62 rules

get 11 rules

list 3 rules

patch 23 rules

update 27 rules

watch 1 rule

rolebindings 28 rules, 8 verbs

create 8 rules

delete 4 rules

list 2 rules

patch 5 rules

replace 1 rule

update 5 rules

watch 1 rule

roles 39 rules, 7 verbs

create 11 rules

delete 3 rules

list 2 rules

patch 10 rules

update 10 rules

watch 1 rule

secrets 52 rules, 8 verbs

create 4 rules

delete 3 rules

get 18 rules

list 14 rules

patch 4 rules

replace 1 rule

update 4 rules

watch 4 rules

selfsubjectaccessreviews 9 rules, 6 verbs

create 4 rules

patch 1 rule

update 1 rule

watch 1 rule

selfsubjectrulesreviews 10 rules, 6 verbs

create 5 rules

patch 1 rule

update 1 rule

watch 1 rule

serviceaccounts 12 rules, 6 verbs

create 5 rules

list 2 rules

patch 1 rule

update 1 rule

watch 1 rule

services 11 rules, 3 verbs

create 7 rules

patch 2 rules

update 2 rules

statefulsets 6 rules, 6 verbs

create 1 rule

patch 1 rule

update 1 rule

watch 1 rule

subjectaccessreviews 6 rules, 6 verbs

create 1 rule

patch 1 rule

update 1 rule

watch 1 rule

validatingwebhookconfiguration 2 rules, 1 verb

create 2 rules

validatingwebhookconfigurations 13 rules, 5 verbs

create 4 rules

delete 2 rules

patch 3 rules

replace 1 rule

update 3 rules

Attributed to a resource, not a specific verb

14 rules that name a Kubernetes resource but no single audit verb, mapped to that resource's catch-all event.

clusterrolebindings 1 rule, 1 verb

(any) 1 rule

clusterroles 1 rule, 1 verb

(any) 1 rule

configmaps 1 rule, 1 verb

(any) 1 rule

namespaces 1 rule, 1 verb

(any) 1 rule

nodes 4 rules, 1 verb

(any) 4 rules

pods 7 rules, 1 verb

(any) 7 rules

rolebindings 1 rule, 1 verb

(any) 1 rule

roles 1 rule, 1 verb

(any) 1 rule

secrets 4 rules, 1 verb

(any) 4 rules

serviceaccounts 1 rule, 1 verb

(any) 1 rule

Not attributed to a Kubernetes audit verb

107 rules that resolve to no Kubernetes resource.

(unattributed) 107 rules, 1 verb

(any) 107 rules