LoFP / eks cluster being created or deleted may be performed by a system administrator.

Techniques

• t1485

Sample rules

AWS EKS Cluster Created or Deleted

• source: sigma
• technicques:
  • t1485

Description

Identifies when an EKS cluster is created or deleted.

Detection logic

condition: selection
selection:
  eventName:
  - CreateCluster
  - DeleteCluster
  eventSource: eks.amazonaws.com