{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-497-check-both-kubernetes-collection-controls-before-excluding-a-namespace/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-497-check-both-kubernetes-collection-controls-before-excluding-a-namespace/", "slug": "dse-20260909-497-check-both-kubernetes-collection-controls-before-excluding-a-namespace", "url": "https://update.dsesecurity.com/updates/dse-20260909-497-check-both-kubernetes-collection-controls-before-excluding-a-namespace/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-497-check-both-kubernetes-collection-controls-before-excluding-a-namespace.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-497-check-both-kubernetes-collection-controls-before-excluding-a-namespace/" }, "title": "Check both Kubernetes collection controls before excluding a namespace", "summary": "Why can logs from an excluded namespace still reach Azure Monitor?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:23:39+00:00", "modified_at": "2026-09-10T02:08:05+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 244, "potentially_affected": "Kubernetes clusters using Azure Monitor agent log collection with ConfigMap and data collection rule configuration.", "dse_recommendation": "Specify namespace exclusion separately for container output and other collected logs, and verify both paths.", "primary_source": { "name": "Filter and customize data collection for Kubernetes clusters - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-data-collection-configure", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure Monitor’s Kubernetes namespace filters have different reach: the ConfigMap filters container output, while the data collection rule filters other logs. Completely excluding a namespace requires configuration in both places. Container output must also be enabled in both the ConfigMap and the DCR’s ContainerLogV2 stream; ConfigMap can independently disable stdout or stderr. These are complementary controls, not interchangeable copies of one setting. Microsoft Learn.

\n

Applicability

\n

Use this distinction only where ConfigMap-based Azure Monitor log collection is supported and in use. Identify whether the requirement excludes all namespace logs or only selected container output. Do not translate an output-only request into a broader loss of operational records.

\n

DSE recommendation

\n

Specify namespace exclusion separately for container output and other collected logs, and verify both paths. Ask the workload owner to identify records that must remain available during an incident. Have the collection owner review the effective ConfigMap and associated log DCR together before approving the scope. Keep an explicit reason for any intentional difference between their namespace selections.

\n

Verification

\n

In an authorized test namespace, produce recognizable stdout and stderr messages and an appropriate non-container log event. Check the expected destination for each record class after the proposed change. Record which classes should disappear and which should remain, then investigate any mismatch against the corresponding control. Preserve the before-and-after configuration with the observed results; a saved exclusion field alone is not the acceptance evidence.

\n

Official references

\n

Microsoft Learn: Kubernetes data collection customization. Source reviewed September 9, 2026.

", "content_text": "Source facts\nAzure Monitor’s Kubernetes namespace filters have different reach: the ConfigMap filters container output, while the data collection rule filters other logs. Completely excluding a namespace requires configuration in both places. Container output must also be enabled in both the ConfigMap and the DCR’s ContainerLogV2 stream; ConfigMap can independently disable stdout or stderr. These are complementary controls, not interchangeable copies of one setting. Microsoft Learn.\nApplicability\nUse this distinction only where ConfigMap-based Azure Monitor log collection is supported and in use. Identify whether the requirement excludes all namespace logs or only selected container output. Do not translate an output-only request into a broader loss of operational records.\nDSE recommendation\nSpecify namespace exclusion separately for container output and other collected logs, and verify both paths. Ask the workload owner to identify records that must remain available during an incident. Have the collection owner review the effective ConfigMap and associated log DCR together before approving the scope. Keep an explicit reason for any intentional difference between their namespace selections.\nVerification\nIn an authorized test namespace, produce recognizable stdout and stderr messages and an appropriate non-container log event. Check the expected destination for each record class after the proposed change. Record which classes should disappear and which should remain, then investigate any mismatch against the corresponding control. Preserve the before-and-after configuration with the observed results; a saved exclusion field alone is not the acceptance evidence.\nOfficial references\nMicrosoft Learn: Kubernetes data collection customization. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nAzure Monitor’s Kubernetes namespace filters have different reach: the ConfigMap filters container output, while the data collection rule filters other logs. Completely excluding a namespace requires configuration in both places. Container output must also be enabled in both the ConfigMap and the DCR’s ContainerLogV2 stream; ConfigMap can independently disable stdout or stderr. These are complementary controls, not interchangeable copies of one setting. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-data-collection-configure).\n\n## Applicability\n\nUse this distinction only where ConfigMap-based Azure Monitor log collection is supported and in use. Identify whether the requirement excludes all namespace logs or only selected container output. Do not translate an output-only request into a broader loss of operational records.\n\n## DSE recommendation\n\nSpecify namespace exclusion separately for container output and other collected logs, and verify both paths. Ask the workload owner to identify records that must remain available during an incident. Have the collection owner review the effective ConfigMap and associated log DCR together before approving the scope. Keep an explicit reason for any intentional difference between their namespace selections.\n\n## Verification\n\nIn an authorized test namespace, produce recognizable stdout and stderr messages and an appropriate non-container log event. Check the expected destination for each record class after the proposed change. Record which classes should disappear and which should remain, then investigate any mismatch against the corresponding control. Preserve the before-and-after configuration with the observed results; a saved exclusion field alone is not the acceptance evidence.\n\n## Official references\n\n[Microsoft Learn: Kubernetes data collection customization](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-data-collection-configure). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-497-check-both-kubernetes-collection-controls-before-excluding-a-namespace/", "url": "https://update.dsesecurity.com/updates/dse-20260909-497-check-both-kubernetes-collection-controls-before-excluding-a-namespace/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-497-check-both-kubernetes-collection-controls-before-excluding-a-namespace/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check both Kubernetes collection controls before excluding a namespace", "item": "https://update.dsesecurity.com/updates/dse-20260909-497-check-both-kubernetes-collection-controls-before-excluding-a-namespace/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-497-check-both-kubernetes-collection-controls-before-excluding-a-namespace/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-497-check-both-kubernetes-collection-controls-before-excluding-a-namespace/", "url": "https://update.dsesecurity.com/updates/dse-20260909-497-check-both-kubernetes-collection-controls-before-excluding-a-namespace/", "headline": "Check both Kubernetes collection controls before excluding a namespace", "description": "Why can logs from an excluded namespace still reach Azure Monitor?", "abstract": "Why can logs from an excluded namespace still reach Azure Monitor?", "articleBody": "Source facts\nAzure Monitor’s Kubernetes namespace filters have different reach: the ConfigMap filters container output, while the data collection rule filters other logs. Completely excluding a namespace requires configuration in both places. Container output must also be enabled in both the ConfigMap and the DCR’s ContainerLogV2 stream; ConfigMap can independently disable stdout or stderr. These are complementary controls, not interchangeable copies of one setting. Microsoft Learn.\nApplicability\nUse this distinction only where ConfigMap-based Azure Monitor log collection is supported and in use. Identify whether the requirement excludes all namespace logs or only selected container output. Do not translate an output-only request into a broader loss of operational records.\nDSE recommendation\nSpecify namespace exclusion separately for container output and other collected logs, and verify both paths. Ask the workload owner to identify records that must remain available during an incident. Have the collection owner review the effective ConfigMap and associated log DCR together before approving the scope. Keep an explicit reason for any intentional difference between their namespace selections.\nVerification\nIn an authorized test namespace, produce recognizable stdout and stderr messages and an appropriate non-container log event. Check the expected destination for each record class after the proposed change. Record which classes should disappear and which should remain, then investigate any mismatch against the corresponding control. Preserve the before-and-after configuration with the observed results; a saved exclusion field alone is not the acceptance evidence.\nOfficial references\nMicrosoft Learn: Kubernetes data collection customization. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:23:39+00:00", "dateModified": "2026-09-10T02:08:05+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-497-check-both-kubernetes-collection-controls-before-excluding-a-namespace/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-497-check-both-kubernetes-collection-controls-before-excluding-a-namespace/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check both Kubernetes collection controls before excluding a namespace" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 244, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Filter and customize data collection for Kubernetes clusters - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-data-collection-configure" } } ] } }