✄𐘗
text code block:
✄𐘗FROM logs-aws.eks_audit-* metadata _id, _index, _version
| WHERE
  aws.eks.audit.objectRef.resource in ("roles", "clusterroles") and
  aws.eks.audit.verb in ("create", "update", "patch") and
  `aws.eks.audit.annotations.authorization_k8s_io/decision` == "allow" and
  aws.eks.audit.level == "RequestResponse" and aws.eks.audit.stage == "ResponseComplete" and
  not aws.eks.audit.sourceIPs in ("::1", "127.0.0.1") and
  not user.name like "eks:*" and
  not (user.name == "system:serviceaccount:kube-system:clusterrole-aggregation-controller" and  aws.eks.audit.objectRef.name in ("admin", "edit") and event.action == "patch") and
  (
    // using requestObject
    KQL(""" aws.eks.audit.requestObject.rules.verbs:("*" or "escalate" or "bind" or "impersonate") """) or
    KQL(""" aws.eks.audit.requestObject.rules.verbs: ("*" or "create" or "patch" or "update") and aws.eks.audit.requestObject.rules.resources:("*" or "clusterroles" or "clusterrolebindings" or "roles" or "rolebindings" or "pods/exec" or "serviceaccounts/token" or "nodes/proxy" or "daemonsets") """) or
    KQL(""" aws.eks.audit.requestObject.rules.verbs: ("*" or "get" or "list") and aws.eks.audit.requestObject.rules.resources:("*" or "secrets") """) or

    // using responseObject
    KQL(""" aws.eks.audit.responseObject.rules.verbs:("*" or "escalate" or "bind" or "impersonate") """) or
    KQL(""" aws.eks.audit.responseObject.rules.verbs: ("*" or "create" or "patch" or "update") and aws.eks.audit.responseObject.rules.resources:("*" or "clusterroles" or "clusterrolebindings" or "roles" or "rolebindings" or "pods/exec" or "serviceaccounts/token" or "nodes/proxy" or "daemonsets") """) or
    KQL(""" aws.eks.audit.responseObject.rules.verbs: ("*" or "get" or "list") and aws.eks.audit.responseObject.rules.resources:("*" or "secrets") """)
  )
| keep user.name, user_agent.original, event.action, source.ip, aws.eks.audit.verb, aws.eks.audit.objectRef.resource, aws.eks.audit.objectRef.name, aws.eks.audit.requestURI, aws.eks.audit.user.username, aws.eks.audit.user.groups, `aws.eks.audit.annotations.authorization_k8s_io/decision`, event.original, _id, _version, _index, data_stream.namespace