Infrastructure Change Detection¶

Document Positioning

This document is the second step in the detection rule configuration process. After completing the configuration, return to the main document to continue to Step 3: Event Notification.

Data scope: Object (O). By continuously monitoring Kubernetes resource configuration changes (such as YAML file modifications), combined with version tracking and intelligent analysis, it enables compliance checks, fault root cause identification, and resource usage optimization, ultimately ensuring cluster security, stability, and resource efficiency.

Detection Configuration¶

Detection Frequency¶

Set the time interval for executing detection.

Preset options: 30 seconds, 1 minute, 5 minutes, 10 minutes, 15 minutes, 30 minutes, 1 hour
Crontab mode: Click "Switch to Crontab mode" to configure a custom interval. Scheduled tasks can be configured based on seconds, minutes, hours, days, months, weeks, and other periods.

Detection Metrics¶

Monitor metric data for multiple infrastructure types.

Configuration Item	Description
Infrastructure Type	Select the Kubernetes resource types to monitor: Deployments, DaemonSets, Services, Cron Jobs, StatefulSets
Detection Target	Select the detection scope: All: Check whether the last report update time of all objects of this type in the workspace triggers the threshold Custom: Use wildcard matching for object names, such as `nginx-*`

Trigger Conditions¶

Configure the trigger conditions for each alert level (Fatal, Critical, Important, Warning).

For more details, see Event Level Description.

Any ChangeRegex Match

When any change occurs to the detected object status, an event is generated immediately.

When a change condition satisfies the regex match, an event is generated immediately.

Example: Define the regular expression as:

(?=.*CPU)(?=.*\berror\b)

This means that if a CPU-related error entry is generated in the detected object, event data will be generated immediately.

Subsequent Configuration¶

After completing the above detection configuration, continue with the following configuration:

Event Notification: Define the event title, content, notification members, data gap handling, and associated incidents;
Alert Configuration: Select an alert policy, set notification targets and mute period;
Link: Link dashboards for quick navigation to view data;
Permissions: Set operation permissions to control who can edit/delete this monitor.

Event Viewing¶

Events triggered by infrastructure change detection can be viewed in Events > Change Events.