✄𐘗
text code block:
✄𐘗sequence by orchestrator.cluster.name, user.name with maxspan=5m
  [any where data_stream.dataset == "aws.eks_audit" and
   `aws.eks.audit.annotations.authorization_k8s_io/decision` == "allow" and
    aws.eks.audit.objectRef.resource in ("roles", "clusterroles") and
    aws.eks.audit.verb in ("create", "update", "patch") and
    not startsWith(user.name, "eks:")]
  [any where data_stream.dataset == "aws.eks_audit" and
   `aws.eks.audit.annotations.authorization_k8s_io/decision` == "allow" and
    aws.eks.audit.objectRef.resource in ("daemonsets", "deployments", "cronjobs") and
    aws.eks.audit.verb in ("create", "patch") and
    /* skip controller status writes and HPA / kubectl scale patches */
    not aws.eks.audit.objectRef.subresource in ("status", "scale") and
    /* reduce control-plane / bootstrap noise */
    not aws.eks.audit.user.groups == "system:masters" and
    not startsWith(user.name, "eks:")
  ]