Kubernetes Pod and Service Discovery via API

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•6

This rule detects HTTP requests to the Kubernetes API endpoint '/api/v1/pods' on port 8080. This activity is indicative of an attempt to discover Kubernetes pods and services, which could be part of reconnaissance by an attacker or an authorized user.