GKE Audit Log FAQ

Why is information missing from the K8s Object Reference tab in the alert details dashboard for GKE audit logs?

Lacework FortiCNAPP can only display information made available by the cloud providers. Because GKE does not include the query string for the event URI, information like the command and UID cannot be found and won’t be displayed in the K8s Object Reference tab.

Why doesn't Lacework FortiCNAPP show the kubectl exec commands for GKE?

GKE does not include the query string for the event URI. Information like the kubectl exec command are not available in the GKE audit logs, so Lacework FortiCNAPP does not have this information to display.