AKS is running without Azure Policy for Kubernetes clusters
An admission controller is a piece of code that intercepts requests to the Kubernetes API server prior to the persistence...
Blog
AKS cluster is not using Azure Active Directory authentication
Azure Kubernetes Service (AKS) can be configured to use Azure Active Directory (AD) for user authentication. In this configuration, you...
AKS cluster is not using Azure Active Directory authorization
The ability to manage RBAC (Role-Based Access Control) for Kubernetes resources from Azure gives you the choice to manage RBAC...
Vm uses unmanaged disk.
VM - {AzureComputeVm} - uses unmanaged Blob based VHD. Managed disks in contrast to unmanaged disks have default features. The...
Create snapshot API call was made from malicious IP address
Orca detected a CreateSnapshot operation attempt. The operation was called from a malicious IP address - {MaliciousIp.MaliciousIp}, which might indicate...
API access from Tor IP address was detected
GCP API call was detected from IP address which is categorized as Tor
Lambda function that exposes secrets is reached from Tor IP address
Orca detected AWS lambda function {AwsLambdaFunction} with environment variables exposing secrets. The function configuration was fetched by one of the...
AWS Guard Duty: User with InitialAccess:IAMUser/AnomalousBehavior
GuardDuty finding was triggered for aws user.