This repository has been archived by the owner on Sep 13, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 104
/
pod.yml
44 lines (44 loc) · 1.54 KB
/
pod.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
name: Pod
definition: A single unit of shared resources within a cluster, comprised of one or more containers
collection_layers:
- Container
platforms:
- Containers
contributors:
- ATT&CK
- Center for Threat-Informed Defense (CTID)
data_components:
- name: Pod Creation
type: activity
description: "Initial construction of a new pod (ex: kubectl apply|run)"
relationships:
- source_data_element: user
relationship: created
target_data_element: pod
- name: Pod Modification
type: activity
description: "Changes made to a pod, including its settings and/or control data (ex: kubectl set|patch|edit)"
relationships:
- source_data_element: user
relationship: modified
target_data_element: pod
- source_data_element: user
relationship: deployed container in
target_data_element: pod
- name: Pod Metadata
type: information
description: "Contextual data about a pod and activity around it such as name, ID, namespace, or status"
relationships:
- source_data_element: user
relationship: retrieved information about
target_data_element: pod
- name: Pod Enumeration
type: activity
description: "An extracted list of pods within a cluster (ex: kubectl get pods)"
relationships:
- source_data_element: user
relationship: listed
target_data_element: pods
references:
- https://kubernetes.io/docs/reference/kubectl/kubectl/
- https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#pod-v1-core