Skip to content

Latest commit

 

History

History
92 lines (79 loc) · 4.99 KB

security-kubernetesserviceevidence.md

File metadata and controls

92 lines (79 loc) · 4.99 KB
Raw
title description author ms.localizationpriority ms.subservice doc_type
kubernetesServiceEvidence resource type
Represents a Kubernetes service entity.
MSRonBorysowski
medium
security
resourcePageType

kubernetesServiceEvidence resource type

Namespace: microsoft.graph.security

[!INCLUDE beta-disclaimer]

Represents Kubernetes service entity.

Inherits from alertEvidence.

Properties

Property Type Description
clusterIP microsoft.graph.security.ipEvidence The service cluster IP.
createdDateTime DateTimeOffset The date and time when the evidence was created and added to the alert. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Inherited from alertEvidence.
externalIPs microsoft.graph.security.ipEvidence collection The service external IPs.
labels microsoft.graph.security.dictionary The service labels.
name String The service name.
namespace microsoft.graph.security.kubernetesNamespaceEvidence The service namespace.
remediationStatus microsoft.graph.security.evidenceRemediationStatus Status of the remediation action taken. The possible values are: none, remediated, prevented, blocked, notFound, unknownFutureValue. Inherited from alertEvidence.
remediationStatusDetails String Details about the remediation status. Inherited from alertEvidence.
roles microsoft.graph.security.evidenceRole collection One or more roles that an evidence entity represents in an alert. For example, an IP address that is associated with an attacker has the evidence role Attacker. Possible values are: unknown, contextual, scanned, source, destination, created, added, compromised, edited, attacked, attacker, commandAndControl, loaded, suspicious, policyViolator, unknownFutureValue. Inherited from alertEvidence.
selector microsoft.graph.security.dictionary The service selector.
servicePorts microsoft.graph.security.kubernetesServicePort collection The list of service ports.
serviceType microsoft.graph.security.kubernetesServiceType The service type.
tags String collection Array of custom tags associated with an evidence instance. For example, to denote a group of devices or high value assets. Inherited from alertEvidence.
verdict microsoft.graph.security.evidenceVerdict The decision reached by automated investigation. The possible values are: unknown, suspicious, malicious, noThreatsFound, unknownFutureValue. Inherited from alertEvidence.

kubernetesServiceType values

Member Description
unknown An unknown service type for forward compatibily.
clusterIP Cluster IP type of the service.
externalName External name type of the service.
nodePort Node port type of the service.
loadBalancer Load balancer type of the service.
unknownFutureValue Evolvable enumeration sentinel value. Do not use.

Relationships

None.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.kubernetesServiceEvidence",
  "clusterIP": {
    "@odata.type": "microsoft.graph.security.ipEvidence"
  },
  "createdDateTime": "String (timestamp)",
  "externalIPs": [{
    "@odata.type": "microsoft.graph.security.ipEvidence"
  }],
  "labels": {
    "@odata.type": "microsoft.graph.security.dictionary"
  },
  "name": "String",
  "namespace": {
    "@odata.type": "microsoft.graph.security.kubernetesNamespaceEvidence"
  },
  "remediationStatus": "String",
  "remediationStatusDetails": "String",
  "roles": ["String"],
  "selector": {
    "@odata.type": "microsoft.graph.security.dictionary"
  },
  "servicePorts": [{
    "@odata.type": "microsoft.graph.security.kubernetesServicePort"
  }],
  "serviceType": "String",
  "tags": ["String"],
  "verdict": "String"
}