✄𐘗
text code block:
✄𐘗from logs-aws.eks_audit-* metadata _id, _index, _version
| eval Esql.time_interval = date_trunc(1 minute, @timestamp)
| where data_stream.dataset == "aws.eks_audit"
    and event.action in ("get", "list")
    and aws.eks.audit.objectRef.resource in ("namespaces", "nodes", "pods", "roles", "configmaps", "serviceaccounts", "clusterroles", "clusterrolebindings", "rolebindings")
    and source.ip is not null and user.name IS NOT NULL
    and not to_string(source.ip) in ("127.0.0.1", "::1")
    and not user.name rlike """(system:serviceaccount:kube-system:|eks:|system:kube-|arn:aws:sts::.*:assumed-role/AWSServiceRoleForAmazonEKS/).*"""
    and not aws.eks.audit.user.username in ("system:serviceaccount:flux-system:kustomize-controller", "system:serviceaccount:flux-system:helm-controller", "system:serviceaccount:flux-system:source-controller", "system:serviceaccount:security:trivy-operator")
| stats
    Esql.unique_resources = count_distinct(aws.eks.audit.objectRef.resource),
    Esql.enumerated_resources = values(aws.eks.audit.objectRef.resource),
    Esql.enumerated_namespaces = values(aws.eks.audit.objectRef.namespace),
    Esql.decisions = values(`aws.eks.audit.annotations.authorization_k8s_io/decision`)
  by user.name, aws.eks.audit.user.username, source.ip, user_agent.original, Esql.time_interval
| where Esql.unique_resources >= 3
| keep Esql.*, aws.eks.audit.user.username, user.name, source.ip, user_agent.original