Azure Kubernetes Service accounts with failed or forbidden status
You want to investigate failed or forbidden status accounts on your network to determine if they represent a threat.
Required data
Procedure
- Ensure that you have configured Kube-Audit data diagnostics.
- Run the following search. You can optimize it by specifying an index and adjusting the time range.
sourcetype=mscs:storage:blob:json category=kube-audit
| spath input=properties.log
| search user.groups{}=system:serviceaccounts* responseStatus.reason=Forbidden
| table sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace
Search explanation
The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.
| Splunk Search | Explanation |
|---|---|
|
sourcetype:mscs:storage:blob:json |
Search only the source type mscs:storage:blob:json. |
|
category=kube-audit |
Search the data source kube-audit from the diagnostic logs in Azure Cloud services. |
|
| spath input=properties.log |
Extract fields from the properties Kube-Audit log. |
|
| search user.groups{}=system:serviceaccounts* responseStatus.reason=Forbidden |
Search for service accounts with a response status of Forbidden. |
|
| table sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace |
Display the results in a table with columns in the order shown. |
Next steps
You can extend this search by using top or rare operators to find trends or rarities in failure status, user agents, source IP addresses, and request URIs. Note that this search can give false positives as there might be inherent issues with authentications and permissions at cluster.
For additional information about this search, such as its applicability to common frameworks and standards, see this project on GitHub for AWS, Azure, or GCP.
Finally, you might be interested in other processes associated with the Monitoring Kubernetes sensitive object access use case.