LoFP LoFP / aws eks kubernetes cluster

TitleTags
not all rbac authorications are malicious. rbac authorizations can uncover malicious activity specially if sensitive roles have been granted.
sensitive object access is not necessarily malicious but user and object context can provide guidance for detection.
sensitive role resource access is necessary for cluster operation, however source ip, namespace and user group may indicate possible malicious use.
this search can give false positives as there might be inherent issues with authentications and permissions at cluster.