Skip to content

Instantly share code, notes, and snippets.

@vicenteherrera

vicenteherrera/anonymous_request_allowed.yaml

Created March 23, 2020 18:07
Show Gist options
  • Save vicenteherrera/efda249d711086bba0ad461c53fa7cec to your computer and use it in GitHub Desktop.
Save vicenteherrera/efda249d711086bba0ad461c53fa7cec to your computer and use it in GitHub Desktop.
Download ZIP
Raw
anonymous_request_allowed.yaml
- rule: Anonymous Request Allowed
desc: >
Detect any request made by the anonymous user that was allowed
condition: kevt and ka.user.name=system:anonymous and ka.auth.decision!=reject and not health_endpoint
output: Request by anonymous user allowed (user=%ka.user.name verb=%ka.verb uri=%ka.uri reason=%ka.auth.reason))
priority: WARNING
source: k8s_audit
tags: [k8s]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment