Kubernetes auditing

The Kubernetes auditing system records the activities of users, administrators, and other components, that have affected the cluster. Prisma Cloud can ingest, analyze, and alert on security-relevant events. Write custom rules or leverage Prisma Cloud Labs prewritten rules to assess the incoming audit stream and surface suspicious activity.
Audits types are limited to the ones been configured by the audit policy of the cloud provider.

Rule library

Custom rules are stored in a central library, where they can be reused. Besides your own rules, Prisma Cloud Labs also distributes rules via the Intelligence Stream. These rules are shipped in a disabled state by default. You can review, and optionally apply them at any time.
Your Kubernetes audit policy is defined in
Defend > Access > Kubernetes
, and formulated from the rules in your library. There are four types of rules, but the only one relevant to the audit policy is the kubernetes-audit type. Custom rules are written and managed in Console under
Defend > Custom configs > Runtime
with an online editor. The compiler checks for syntax errors when you save a rule.

Expression grammar

Expressions let you examine contents of a Kubernetes audit. Expressions have the following grammar:
  • term
    integer | string | keyword | event | '(' expression ')' | unaryOp term
  • in
    '(' integer | string (',' integer | string)*)?
  • op
    and | or | > | < | >= | ⇐ | = | !=
  • unaryOp
  • keyword
    startswith | contains
  • string
    Strings must be enclosed in double quotes
  • integer
  • event
    process, file system, or network

Kubernetes audit events

When Prisma Cloud receives an audit, it is assessed against your policy. Like all policies in Prisma Cloud, rule order is important. Rules are processed top to bottom, and processing stops at the first match. When a rule matches, an alert is raised.
Write rules to surface audits of interest. Rules are written with the