Kubernetes Log Event Deletion
Detects the deletion of Kubernetes log events, which could indicate an attempt at defense evasion or covering tracks by an attacker. The rule looks for 'delete' operations on 'Event' resources while excluding actions by 'ci-admin*' or 'system:*' users to reduce false positives.
Sigma
