✄𐘗
text code block:
✄𐘗from logs-aws.eks_audit-* metadata _id, _index, _version
| where data_stream.dataset == "aws.eks_audit"
    and event.action == "get"
    and aws.eks.audit.objectRef.resource == "secrets"
    and source.ip is not null and user.name is not null
    and not to_string(source.ip) in ("127.0.0.1", "::1")
    and not user.name in ("system:kube-controller-manager", "system:kube-scheduler")
    and not aws.eks.audit.objectRef.name like "sh.helm.release.*"
    and not aws.eks.audit.user.username in (
      "system:serviceaccount:flux-system:kustomize-controller",
      "system:serviceaccount:flux-system:helm-controller",
      "system:serviceaccount:flux-system:source-controller",
      "system:serviceaccount:security:trivy-operator"
    )
| stats
    Esql.unique_credentials = count_distinct(aws.eks.audit.objectRef.name),
    Esql.secrets_names = values(aws.eks.audit.objectRef.name),
    Esql.namespaces = values(aws.eks.audit.objectRef.namespace),
    Esql.event_outcome_values = values(event.outcome),
    Esql.outcome = values(`aws.eks.audit.annotations.authorization_k8s_io/decision`)
  by user.name, aws.eks.audit.user.username, source.ip, user_agent.original
| where Esql.unique_credentials >= 3
| KEEP user.name, aws.eks.audit.user.username, source.ip, user_agent.original, Esql.*