1onsuccess: next_stage
2filter: "evt.Parsed.program == 'k8s-audit'"
3name: crowdsecurity/k8s-audit
4description: "Parse Kubernetes audit logs"
5#Unfortunately, k8s has slightly different JSON when using a webhook or a file (first letter of the keys is capitalized when using the webhook).
6#Explicitly handle the webhook datasource, and assume file-like format for everything else (it could be coming from the syslog datasource for example)
7nodes:
8  - filter: evt.Meta.datasource_type == "k8s-audit"
9    statics:
10    - parsed: k8s_parsed
11      expression: UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, "k8s_audit")
12    - meta: user
13      expression: evt.Unmarshaled.k8s_audit.User.username
14    - meta: source_ip
15      expression: evt.Unmarshaled.k8s_audit.SourceIPs[0]
16    - meta: namespace
17      expression: evt.Unmarshaled.k8s_audit.ObjectRef?.Namespace
18    - meta: resource_name
19      expression: evt.Unmarshaled.k8s_audit.ObjectRef?.Name
20    - meta: kind
21      expression: evt.Unmarshaled.k8s_audit.RequestObject?.kind
22    - meta: log_type
23      value: k8s-audit
24    - target: evt.StrTime
25      expression: evt.Unmarshaled.k8s_audit.RequestReceivedTimestamp
26  - filter: evt.Meta.datasource_type != "k8s-audit"
27    statics:
28    - parsed: k8s_parsed
29      expression: UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, "k8s_audit")
30    - meta: user
31      expression: evt.Unmarshaled.k8s_audit.user.username
32    - meta: source_ip
33      expression: evt.Unmarshaled.k8s_audit.sourceIPs[0]
34    - meta: namespace
35      expression: evt.Unmarshaled.k8s_audit.objectRef?.namespace
36    - meta: resource_name
37      expression: evt.Unmarshaled.k8s_audit.objectRef?.name
38    - meta: kind
39      expression: evt.Unmarshaled.k8s_audit.requestObject?.kind
40    - meta: log_type
41      value: k8s-audit
42    - target: evt.StrTime
43      expression: evt.Unmarshaled.k8s_audit.requestReceivedTimestamp
44