Skip to main content
Splunk Lantern

Azure Kubernetes Service pod scan fingerprinting

Kubernetes pods are a group of one or more containers with shared storage and a specification for how to run the containers. A pod's contents are always co-located and co-scheduled. One of your concerns with using Kubernetes is fingerprinting. You want to know if your pods are being targeted, and, if so, to get details about the files or directories being probed.


  1. Ensure that you have configured Kube-Audit data diagnostics in the Splunk Add-on for Microsoft Cloud Services.
  2. Run the following search. You can optimize it by specifying an index and adjusting the time range.  
sourcetype:mscs:storage:blob:json category=kube-audit 
| spath input=properties.log 
| search responseStatus.code=401 
| table sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod 

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation


Search only the source type mscs:storage:blob:json.


Search the data source kube-audit from the diagnostic logs in Azure Cloud services.

| spath input=properties.log 

Pull information from this specific Kubernetes audit log.

| search responseStatus.code=401 

Search for HTTP Status 401, an unauthorized request.

| table sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod 

Display the results in a table with columns in the order shown.

Next steps

The results provide an IP address, user agent, verb, request URI, and response status. Not all unauthenticated requests are malicious, but these strings can provide clues of the type of tool being used for scanning. Watch for IP addresses flagged as malicious by popular IP reputation lists, such as Team Cymru, and analyze the HTTP verb in relation to the user agent, suspicious IP address, and the target URI to understand the intentions of detected scans.

For additional information about this search, such as its applicability to common frameworks and standards, see this project on GitHub.

Finally, you might be interested in other processes associated with the Detecting Kubernetes scanning activity use case.