Skip to content

Commit 3f1fea2

Browse files
author
David Curwin
committed
Kubeaudit events
1 parent 3704816 commit 3f1fea2

File tree

4 files changed

+104
-1
lines changed

4 files changed

+104
-1
lines changed

‎articles/defender-for-cloud/TOC.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -714,6 +714,9 @@
714714
- name: Kubernetes data plane hardening
715715
displayName: k8s, containers, aks
716716
href: kubernetes-workload-protections.md
717+
- name: Kubeaudit events in advanced hunting
718+
displayName: k8s, containers
719+
href: kubeaudit-events-advanced-hunting.md
717720
- name: Vulnerability assessment for Azure powered by Qualys (Deprecated)
718721
displayName: ACR, registry, images, qualys
719722
href: defender-for-containers-vulnerability-assessment-azure.md

‎articles/defender-for-cloud/defender-for-containers-introduction.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ Defender for Containers assists you with four core domains of container security
1717

1818
- [**Vulnerability assessment**](#vulnerability-assessment) - provides agentless vulnerability assessment for Azure, AWS, and GCP with remediation guidelines, zero configuration, daily rescans, coverage for OS and language packages, and exploitability insights.
1919

20-
- [**Run-time threat protection**](#run-time-protection-for-kubernetes-nodes-and-clusters) - a rich threat detection suite for Kubernetes clusters, nodes, and workloads, powered by Microsoft leading threat intelligence, provides mapping to MITRE ATT&CK framework for easy understanding of risk and relevant context, automated response, and SIEM/XDR integration.
20+
- [**Run-time threat protection**](#run-time-protection-for-kubernetes-nodes-and-clusters) - a rich threat detection suite for Kubernetes clusters, nodes, and workloads, powered by Microsoft leading threat intelligence, provides mapping to MITRE ATT&CK framework for easy understanding of risk and relevant context, automated response, and [SIEM/XDR integration](kubeaudit-events-advanced-hunting.md).
2121

2222
- **Deployment & monitoring**- Monitors your Kubernetes clusters for missing sensors and provides frictionless at-scale deployment for sensor-based capabilities, support for standard Kubernetes monitoring tools, and management of unmonitored resources.
2323

‎articles/defender-for-cloud/kubeaudit-events-advanced-hunting.md

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
---
2+
title: Kubeaudit events in advanced hunting
3+
description: Learn how you can use Kubernetes Kubeaudit events for advanced hunting in the Microsoft Defender portal.
4+
ms.topic: how-to
5+
author: dcurwin
6+
ms.author: dacurwin
7+
ms.date: 05/28/2024
8+
---
9+
10+
# Kubeaudit events in advanced hunting
11+
12+
Kubernetes Kubeaudit events (and Azure Resource Manager cloud audit) are available in advanced hunting in the Microsoft Defender portal.
13+
14+
You can triage and investigate incidents that happened on your Kubernetes control plane attack surface and Azure Resource Management. You can also proactively hunt for threats using [advanced hunting](/defender-xdr/advanced-hunting-overview).
15+
16+
In addition, you can create [custom detections](/defender-xdr/custom-detection-rules) for suspicious Resource Manager and Kubernetes (KubeAudit) control plane activities.
17+
18+
This feature covers:
19+
20+
- Kubernetes KubeAudit events from Azure (Azure Kubernetes Service), Amazon Web Services (Amazon Elastic Kubernetes Service), Google Cloud Platform (Google Kubernetes Engine) and on-premises
21+
22+
- Resource Manager control plane events
23+
24+
To start, see the new table that was added to the Schema tab in advanced hunting called **CloudAuditEvents**.
25+
26+
:::image type="content" source="media/kubeaudit-events-advanced-hunting/cloud-audit-events.png" alt-text="Screenshot of CloudAuditEvents table in Schema tab in advanced hunting." lightbox="media/kubeaudit-events-advanced-hunting/cloud-audit-events.png":::
27+
28+
## Common use cases and scenarios
29+
30+
- Investigate suspicious Resource Manager and Kubernetes (Kubeaudit) control plane activities in XDR advanced hunting
31+
- Create custom detections for suspicious Resource Manager and Kubernetes (Kubeaudit) control plane activities
32+
33+
## Prerequisites
34+
35+
- **For Kubernetes events:** you need at least one subscription with a Defender for Containers plan enabled
36+
- **For Azure Resource Manager events:** you need at least one subscription with a Defender for Azure Resource Manager plan enabled
37+
38+
## Sample queries
39+
40+
To surface deployment of a privileged pod, use the following sample query:
41+
42+
```kusto
43+
CloudAuditEvents
44+
| where Timestamp > ago(1d)
45+
| where DataSource == "Azure Kubernetes Service"
46+
| where OperationName == "create"
47+
| where RawEventData.ObjectRef.resource == "pods" and isnull(RawEventData.ObjectRef.subresource)
48+
| where RawEventData.ResponseStatus.code startswith "20"
49+
| extend PodName = RawEventData.RequestObject.metadata.name
50+
| extend PodNamespace = RawEventData.ObjectRef.namespace
51+
| mv-expand Container = RawEventData.RequestObject.spec.containers
52+
| extend ContainerName = Container.name
53+
| where Container.securityContext.privileged == "true"
54+
| extend Username = RawEventData.User.username
55+
| project Timestamp, AzureResourceId , OperationName, IPAddress, UserAgent, PodName, PodNamespace, ContainerName, Username
56+
```
57+
58+
To surface the *exec* command in the *kube-system* namespace, use the following sample query:
59+
60+
```kusto
61+
CloudAuditEvents
62+
| where Timestamp > ago(1d)
63+
| where DataSource == "Azure Kubernetes Service"
64+
| where OperationName == "create"
65+
| where RawEventData.ObjectRef.resource == "pods" and RawEventData.ResponseStatus.code == 101
66+
| where RawEventData.ObjectRef.namespace == "kube-system"
67+
| where RawEventData.ObjectRef.subresource == "exec"
68+
| where RawEventData.ResponseStatus.code == 101
69+
| extend RequestURI = tostring(RawEventData.RequestURI)
70+
| extend PodName = tostring(RawEventData.ObjectRef.name)
71+
| extend PodNamespace = tostring(RawEventData.ObjectRef.namespace)
72+
| extend Username = tostring(RawEventData.User.username)
73+
| where PodName !startswith "tunnelfront-" and PodName !startswith "konnectivity-" and PodName !startswith "aks-link"
74+
| extend Commands = extract_all(@"command=([^\&]*)", RequestURI)
75+
| extend ParsedCommand = url_decode(strcat_array(Commands, " "))
76+
| project Timestamp, AzureResourceId , OperationName, IPAddress, UserAgent, PodName, PodNamespace, Username, ParsedCommand
77+
```
78+
79+
To identify the creation of the *cluster-admin* role binding, use the following sample query:
80+
81+
```kusto
82+
CloudAuditEvents
83+
| where Timestamp > ago(1d)
84+
| where OperationName == "create"
85+
| where RawEventData.ObjectRef.resource == "clusterrolebindings"
86+
| where RawEventData.ResponseStatus.code startswith "20"
87+
| where RawEventData.RequestObject.roleRef.name == "cluster-admin"
88+
| mv-expand Subject = RawEventData.RequestObject.subjects
89+
| extend SubjectName = tostring(Subject.name)
90+
| extend SubjectKind = tostring(Subject["kind"])
91+
| extend BindingName = tostring(RawEventData.ObjectRef.name)
92+
| extend ActionTakenBy = tostring(RawEventData.User.username)
93+
| where ActionTakenBy != "acsService" //Remove FP
94+
| project Timestamp, AzureResourceId , OperationName, ActionTakenBy, IPAddress, UserAgent, BindingName, SubjectName, SubjectKind
95+
```
96+
97+
## Related content
98+
99+
- [Advanced hunting overview](/defender-xdr/advanced-hunting-overview)
100+
- [CloudAuditEvents](/defender-xdr/advanced-hunting-cloudauditevents-table)

‎articles/defender-for-cloud/media/kubeaudit-events-advanced-hunting/cloud-audit-events.png

82.9 KB
Loading

0 commit comments

Comments
 (0)