40 lines
1.2 KiB
JSON
40 lines
1.2 KiB
JSON
{"kind":"Event","apiVersion":"audit.k8s.io/v1",
|
|
"level":"RequestResponse",
|
|
"auditID":"a4",
|
|
"stage":"ResponseComplete",
|
|
"requestReceivedTimestamp":"2026-08-04T03:16:22Z",
|
|
"verb":"create",
|
|
"user":{"username":"system:serviceaccount:payments:api",
|
|
"groups":["system:serviceaccounts"]},
|
|
"sourceIPs":["10.244.3.77"],
|
|
"objectRef":{"apiGroup":"rbac.authorization.k8s.io",
|
|
"resource":"clusterrolebindings","name":"payments-api-admin"},
|
|
"responseStatus":{"code":201}}
|
|
|
|
{"kind":"Event",
|
|
"apiVersion":"audit.k8s.io/v1",
|
|
"level":"RequestResponse",
|
|
"auditID":"a5",
|
|
"stage":"ResponseComplete",
|
|
"requestReceivedTimestamp":"2026-08-04T03:16:40Z",
|
|
"verb":"get","user":{"username":"system:serviceaccount:payments:api",
|
|
"groups":["system:serviceaccounts"]},
|
|
"sourceIPs":["10.244.3.77"],
|
|
"objectRef":{"resource":"secrets",
|
|
"namespace":"payments",
|
|
"name":"prod-db"},"responseStatus":{"code":200}}
|
|
|
|
Which principal is suspicious?
|
|
a4 and a5 a6
|
|
What source IP is associated with the activity?
|
|
10.244.3.77
|
|
What is the earliest suspicious timestamp?
|
|
"2026-08-04T03:16:22Z"
|
|
Which ClusterRoleBinding was created?
|
|
payments-api-admin
|
|
Which Secret was accessed?
|
|
"prod-db"
|
|
What runtime action followed the Secret access?
|
|
exec
|
|
Give two immediate containment actions, in order.
|
|
get secret, exec in pod |