gcp:audit io.k8s.core.v1.pods.create
io.k8s.core.v1.pods.create
- Log source
- Google Cloud Audit Logs
- Host type
- Google Cloud (and Google Workspace)
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- Elastic 8
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Google Cloud project and Workspace | Recommended |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Elastic 8
- GKE Anonymous Pod Create/Update/Patch
- GKE Container Created with Excessive Linux Capabilities
- GKE Pod Created With HostIPC
- GKE Pod Created With HostNetwork
- GKE Pod Created With HostPID
- GKE Pod Created with a Sensitive hostPath Volume
- GKE Privileged Pod Created
- GKE Suspicious Assignment of Controller Service Account