Skip to main content
Lantern Home
Splunk Lantern

Monitoring Kubernetes sensitive role activities

  1. Last updated
  2. Save as PDF

Kubernetes is the most used container orchestration platform. It contains sensitive roles that, if accessed by an attacker, can lead to cluster compromise. These roles can define permissions on namespaces or clusters, grant access to cluster-scoped resources and non-resource endpoints, and read secrets.

You want to detect sensitive role usage within your Kubernetes clusters to verify that activity is legitimate. You can use this use case to help you detect suspicious requests against Kubernetes sensitive role activities.

Data required 

Kubernetes data

How to use Splunk software for this use case

You can run many searches with Splunk software to monitor Kubernetes sensitive role activities. Depending on what information you have available, you might find it useful to identify some or all of the following: 

Next steps

To maximize their benefit, the how-to articles linked in the previous section likely need to tie into existing processes at your organization or become new standard processes. These processes commonly impact success with this use case: 

Measuring impact and benefit is critical to assessing the value of monitoring Kubernetes sensitive role activities. The following are example metrics that you can track when implementing this use case:

  • Permission requests from unknown or unauthorized users
  • Sensitive role activities performed by unknown or unauthorized users
  • Top sources of IP addresses, users and user groups requesting or performing activities under sensitive roles

If you have questions about this use case, see the Security Research team's support options on GitHub. In addition, these Splunk resources might help you understand and implement this use case:

Need technical help? Explore our customer success resources to find education and training, engage experts through OnDemand services, view support options, and more.