[Tuning] Kubernetes Secrets List Across Cluster or Sensitive Namespaces

rules/integrations/kubernetes/credential_access_kubernetes_secrets_list_cluster_and_sensitive_namespaces.toml

@@ -2,7 +2,7 @@
 creation_date = "2026/04/22"
 integration = ["kubernetes"]
 maturity = "production"
-updated_date = "2026/05/11"
+updated_date = "2026/08/24"
 
 [rule]
 author = ["Elastic"]
@@ -55,8 +55,8 @@ event.dataset:"kubernetes.audit_logs" and event.action:list and
 kubernetes.audit.objectRef.resource:secrets and 
 kubernetes.audit.requestURI :(/api/v1/secrets or /api/v1/secrets?limit* or /api/v1/namespaces/kube-system/secrets or /api/v1/namespaces/kube-system/secrets?limit* or /api/v1/namespaces/default/secrets or /api/v1/namespaces/default/secrets?limit*) and 
 source.ip:(* and not ("::1" or "127.0.0.1")) and 
-not user.name: (system\:kube-controller-manager or eks\:cloud-controller-manager or eks\:kms-storage-migrator) and 
-not kubernetes.audit.user.groups:"system:serviceaccounts:ibm-csi"
+not user.name: (system\:kube-controller-manager or eks\:cloud-controller-manager or eks\:kms-storage-migrator or "system:serviceaccount:argocd:argocd-application-controller" or "system:serviceaccount:elastic:kube-state-metrics" or "system:serviceaccount:cert-manager:cert-manager-cainjector" or "system:serviceaccount:elastic-system:elastic-agent" or "system:serviceaccount:longhorn-system:longhorn-service-account") and 
+not kubernetes.audit.user.groups:("system:serviceaccounts:ibm-csi" or "system:serviceaccounts:argocd" or "system:serviceaccounts:elastic")
 '''
 
 [[rule.threat]]