✄𐘗
text code block:
✄𐘗from logs-azure.platformlogs-* metadata _id, _index, _version
| where data_stream.dataset == "azure.platformlogs"
    and event.action == "Microsoft.ContainerService/managedClusters/diagnosticLogs/Read"
    and azure.platformlogs.category == "kube-audit"
| eval Esql.stage = field_extract(azure.platformlogs.properties, "log.stage"),
    Esql.verb = field_extract(azure.platformlogs.properties, "log.verb"),
    Esql.resource = field_extract(azure.platformlogs.properties, "log.objectRef.resource"),
    Esql.namespace = field_extract(azure.platformlogs.properties, "log.objectRef.namespace"),
    Esql.username = field_extract(azure.platformlogs.properties, "log.user.username"),
    Esql.user_agent = field_extract(azure.platformlogs.properties, "log.userAgent"),
    Esql.source_ips = field_extract(azure.platformlogs.properties, "log.sourceIPs")
| where Esql.stage == "ResponseComplete"
    and Esql.verb in ("list", "get")
    and Esql.resource in ("namespaces", "nodes", "pods", "roles", "clusterroles", "configmaps", "serviceaccounts", "rolebindings", "clusterrolebindings")
    and Esql.username is not null
    and (Esql.namespace is null or Esql.namespace != "elastic-system")
    and not Esql.username rlike "system:node:.*|system:serviceaccount:kube-system:.*|system:serviceaccount:elastic-system:.*"
    and not Esql.username in ("aksService", "hcpService", "readinessChecker", "acsService", "system:apiserver", "system:kube-controller-manager", "system:kube-scheduler")
    and not Esql.user_agent rlike """(resourcesyncoperator|identityOperator|telegraf|clustermetadatasync|ConfigurationAgent|manager|extensionmanager)/.*\(linux/amd64\) kubernetes/\$Format|Helm/.*|.*Terraform.*|OpenAPI-Generator/.*"""
| eval Esql.namespace = coalesce(Esql.namespace, "(cluster-scoped)")
| stats
    Esql.unique_resources = count_distinct(Esql.resource),
    Esql.enumerated_resources = values(Esql.resource),
    Esql.enumerated_namespaces = values(Esql.namespace),
    Esql.source_ip_values = values(Esql.source_ips),
    Esql.username_values = values(Esql.username),
    Esql.event_count = count(*),
    Esql.earliest_timestamp = min(@timestamp),
    Esql.latest_timestamp = max(@timestamp)
  by Esql.username, Esql.user_agent, azure.resource.id
| where Esql.unique_resources >= 3
| keep Esql.*, azure.resource.id