kubernetes_aws_detect_most_active_service_accounts_by_pod.yml

name: Kubernetes AWS detect most active service accounts by pod
id: 5b30b25d-7d32-42d8-95ca-64dfcd9076e6
version: 1
date: '2020-06-23'
author: Rod Soto, Splunk
status: deprecated
type: Hunting
description: This search provides information on Kubernetes service accounts,accessing
  pods by IP address, verb and decision
data_source: []
search: '`aws_cloudwatchlogs_eks` user.groups{}=system:serviceaccounts  objectRef.resource=pods
  | table  sourceIPs{} user.username userAgent verb annotations.authorization.k8s.io/decision  |
  top  sourceIPs{} user.username verb annotations.authorization.k8s.io/decision |`kubernetes_aws_detect_most_active_service_accounts_by_pod_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
  search works with cloudwatch logs
known_false_positives: Not all service accounts interactions are malicious. Analyst
  must consider IP, verb and decision context when trying to detect maliciousness.
references: []
tags:
  analytic_story:
  - Kubernetes Sensitive Role Activity
  asset_type: AWS EKS Kubernetes cluster
  confidence: 50
  impact: 50
  message: tbd
  observable:
  - name: field
    type: Unknown
    role:
    - Unknown
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  risk_score: 25
  security_domain: threat