who_shelled_into_pod
Identify users who accessed a specific pod within a given namespace and time range. Use this tool to retrieve audit events and enhance Kubernetes security incident analysis.
Instructions
Get users who shelled into a pod with the given name and namespace around the given time
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| cluster_id | No | Optional Cluster ID | |
| from_time | No | Start time of the time range to search for audit events. Example: 2024-01-01T00:00:00Z. Default: 7 days ago | |
| limit | No | Maximum number of results to return | |
| name | No | Optional Pod name | |
| namespace | No | Optional Pod namespace | |
| page | No | Page number to return | |
| to_time | No | End time of the time range to search for audit events. Example: 2024-01-03T00:00:00Z |