The Kubernetes auditing system records the activities of users, administrators, and other components, that have affected the cluster. Prisma Cloud can ingest, analyze, and alert on security-relevant events. Write custom rules or leverage Prisma Cloud Labs prewritten rules to assess the incoming audit stream and surface suspicious activity.
Audits types are limited to the ones been configured by the audit policy of the cloud provider.
Custom rules are stored in a central library, where they can be reused. Besides your own rules, Prisma Cloud Labs also distributes rules via the Intelligence Stream. These rules are shipped in a disabled state by default. You can review, and optionally apply them at any time.
Your Kubernetes audit policy is defined in
Defend > Access > Kubernetes, and formulated from the rules in your library. There are four types of rules, but the only one relevant to the audit policy is the kubernetes-audit type. Custom rules are written and managed in Console under
Defend > Custom configs > Runtimewith an online editor. The compiler checks for syntax errors when you save a rule.
Expressions let you examine contents of a Kubernetes audit. Expressions have the following grammar:
- term--integer | string | keyword | event | '(' expression ')' | unaryOp term
- in--'(' integer | string (',' integer | string)*)?
- op--and | or | > | < | >= | ⇐ | = | !=
- keyword--startswith | contains
- string--Strings must be enclosed in double quotes
- event--process, file system, or network
Kubernetes audit events
When Prisma Cloud receives an audit, it is assessed against your policy. Like all policies in Prisma Cloud, rule order is important. Rules are processed top to bottom, and processing stops at the first match. When a rule matches, an alert is raised.
Write rules to surface audits of interest. Rules are written with the