2 Commits

Author	SHA1	Message	Date
Isai	5b8593559c	[Rule Tuning] Kubernetes - update min_stack for new rules (#2310) ... ## Link to rule https://github.com/elastic/detection-rules/blob/main/rules/integrations/kubernetes/discovery_denied_service_account_request.toml https://github.com/elastic/detection-rules/blob/main/rules/integrations/kubernetes/initial_access_anonymous_request_authorized.toml https://github.com/elastic/detection-rules/blob/main/rules/integrations/kubernetes/privilege_escalation_suspicious_assignment_of_controller_service_account.toml ## Description <!-- Provide a detailed description of the suggested changes --> min_stack change to 8.4 with new required fields added to Kubernetes Integration	2022-09-20 17:09:22 -04:00
Isai	fa0310d0fb	[New Rule] Kubernetes Anonymous Request Authorized (#2300) ... * [New Rule] Kubernetes Anonymous Request Authorized ## Issue #2038 ## Summary This rule detects when an unauthenticated user request is authorized within the cluster. Attackers may attempt to use anonymous accounts to gain initial access to the cluster or to avoid attribution of their activities within the cluster. This rule excludes the /healthz, /livez and /readyz endpoints which are commonly accessed anonymously. * [New Rule] Kubernetes Suspicious Change to Privileges of Running Security Context ## Issue https://github.com/elastic/detection-rules/issues/2032 ## Summary * Delete non-ecs-schema.json * Delete privilege_escalation_suspicious_change_to_privileges_of_running_security_context.toml * Create non-ecs-schema.json * Update detection_rules/etc/non-ecs-schema.json Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>	2022-09-19 11:33:09 -05:00