Resource provisioned using kubectl in container
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Goal
Detect the use of kubectl
inside a container to provision new resources.
Strategy
This detection triggers when kubectl
is executed with specific arguments related to provisioning resources, such as creating a namespace and running a pod.
Triage and response
- Identify the purpose of the container using tags, such as the image and service tags.
- Determine the resources involved, such as new containers.
- Initiate the incident response process.
- Remediate compromised resources and repair the root cause.
Requires Agent version 7.27 or greater