Skip to main content

GKE Audit Log FAQ

Why is information missing from the K8s Object Reference tab in the alert details dossier for GKE audit logs?​

Lacework can only display information made available by the cloud providers. Because GKE does not include the query string for the event URI, information like the command and UID cannot be found and won’t be displayed in the K8s Object Reference tab.

Why doesn't Lacework show the kubectl exec commands for GKE?​

GKE does not include the query string for the event URI. Information like the kubectl exec command are not available in the GKE audit logs, so Lacework does not have this information to display.