« GKE Ephemeral Container Added to Pod GKE Forbidden Creation Request »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

GKE Exposed Service Created With Type NodePort

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

GKE Exposed Service Created With Type NodePort

edit

Detects creation or modification of a GKE Service with type NodePort. NodePort exposes a static port on every worker node that hosts matching pods, which widens the cluster’s external attack surface and can bypass load-balancer and firewall controls. Attackers may create NodePort Services to intercept traffic or establish a direct path into the cluster.

Rule type: query

Rule indices:

  • logs-gcp.audit-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Cloud
  • Domain: Kubernetes
  • Data Source: GCP
  • Data Source: Google Cloud Platform
  • Use Case: Threat Detection
  • Tactic: Persistence
  • Tactic: Initial Access
  • Resources: Investigation Guide

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating GKE Exposed Service Created With Type NodePort

NodePort opens a port on each worker node hosting the service and forwards external traffic to labeled pods. Confirm whether the exposure was approved and which workloads are reachable.

Possible investigation steps

  • Review client.user.email, source.ip, and user_agent.original.
  • Inspect gcp.audit.resource_name and gcp.audit.request for the service name, namespace, selector, and port.
  • Identify the backing pods and whether the NodePort is required for a legitimate external entrypoint.
  • Correlate with recent Service or networking changes from the same actor.

False positive analysis

  • Approved NodePort Services for lab frontends or custom load balancing may match. Allowlist known automation or namespaces after review.
  • GKE addon reconciliation via system:addon-manager patch is excluded; unexpected create or update from that actor should still be investigated.

Response and remediation

  • Remove or change unauthorized NodePort Services, revoke excess RBAC for Services writes, and review firewall exposure for the opened node ports.

Setup

edit

The GCP Fleet integration with GKE audit logs enabled is required. Request body capture for Service resources is required so gcp.audit.request.spec.type is populated.

Rule query

edit
data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:(
  "io.k8s.core.v1.services.create" or
  "io.k8s.core.v1.services.update" or
  "io.k8s.core.v1.services.patch"
) and gcp.audit.request.spec.type:"NodePort" and not (
  client.user.email:"system:addon-manager" and
  event.action:"io.k8s.core.v1.services.patch"
)

Framework: MITRE ATT&CKTM

« GKE Ephemeral Container Added to Pod GKE Forbidden Creation Request »