Kubernetes vulnerability scanner activity

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2025-01-19

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags	Kubernetes - AGENT
ATT&CK Tactic	Execution (TA0002) Discovery (TA0007)
ATT&CK Technique	Deploy Container (T1610) Container and Resource Discovery (T1613)
Severity	Medium

A Kubernetes cluster was scanned by a known vulnerability scanner.

Usage of known tools and frameworks to exploit Kubernetes clusters.

Check if there is an active attack against the Kubernetes cluster.

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

A Kubernetes cluster was scanned by a known vulnerability scanner from within a container.

Usage of known tools and frameworks to exploit Kubernetes clusters.

Check if there is an active attack against the Kubernetes cluster.