✄𐘗
text code block:
✄𐘗FROM logs-kubernetes.audit_logs-* metadata _id, _index, _version
| WHERE
  kubernetes.audit.objectRef.resource in ("roles", "clusterroles") and
  kubernetes.audit.verb in ("create", "update", "patch") and
  `kubernetes.audit.annotations.authorization_k8s_io/decision` == "allow" and
  kubernetes.audit.level == "RequestResponse" and kubernetes.audit.stage == "ResponseComplete" and
  KQL("""kubernetes.audit.requestObject.rules.verbs:("*" or "escalate" or "bind" or "impersonate") or kubernetes.audit.requestObject.rules.resources:("clusterroles" or "clusterrolebindings" or "roles" or "rolebindings")""")
| KEEP
  @timestamp,
  data_stream.namespace,
  `kubernetes.audit.annotations.authorization_k8s_io/decision`,
  kubernetes.audit.level,
  kubernetes.audit.objectRef.name,
  kubernetes.audit.objectRef.resource,
  kubernetes.audit.requestURI,
  kubernetes.audit.responseStatus.code,
  kubernetes.audit.sourceIPs,
  kubernetes.audit.stage,
  kubernetes.audit.user.groups,
  kubernetes.audit.user.username,
  kubernetes.audit.userAgent,
  kubernetes.audit.verb,
  _id,
  _index,
  _version