Suspicious Modification of Kubernetes Prometheus Rules or Alertmanager Configuration
This rule detects successful attempts by non-approved users or service accounts to delete, patch, or update Kubernetes PrometheusRule or AlertmanagerConfig resources. These resources control critical cluster monitoring and alerting; unauthorized changes could be used to disable security monitoring, modify alert notification channels to hide malicious activity, or tamper with detection capabilities.
Cortex XDR
