Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Kubernetes

 

Use the JSA Custom Properties for Kubernetes Content Extension to closely monitor your Kubernetes deployment.

JSA Custom Properties for Kubernetes Content Extension V1.0.0

The following table shows the custom properties in JSA Custom Properties for Kubernetes Content Extension V1.0.0.

Table 1: Custom Properties in JSA Custom Properties for Kubernetes Content Extension V1.0.0

Name

Optimized

Regex Capture Group

Expressions

API Path

No

 
  • JSON--/"requestURI"

Container Image

No

 
  • JSON--/"requestObject"/"spec"/"containers"[0]/"image"

Container Name

No

 
  • JSON--/"requestObject"/"spec"/"containers"[0]/"name"

MessageID

No

 
  • JSON--/"auditID"

Namespace

Yes

 
  • JSON--/"objectRef"/"namespace"

Privileged Container

Yes

1

  • Regex--\\"containers\\":.*?\\"securityContext\\":\{\\"privileged\\":(true)

Priviliged Container Name

No

1

  • Regex--\\"containers\\":.*\\"name\\":\\"(.*?)\\",\\"securityContext\\":\{\\"privileged\\":true

Process CommandLine

Yes

 
  • Regex--command=(.*?)container=

Reason

Yes

 
  • JSON--/"responseStatus"/"reason"

Resource

Yes

 
  • JSON--/"objectRef"/"resource"

Resource Name

Yes

 
  • JSON--/"objectRef"/"name"

Role

Yes

 
  • JSON--/"requestObject"/"roleRef"/"name"

Role Actions

Yes

 
  • JSON--/"requestObject"/"rules"[0]/"verbs"[]

Role Assigned Resources

Yes

 
  • JSON--/"requestObject"/"rules"[0]/"resources"[]

Target User Name

Yes

1

  • Regex--"subjects"\:\[\{.*?\"name\"\:\"([^\"]+)\"

User Agent

No

 
  • JSON--/"userAgent"

Related Documentation