Health checks

​

Signals

• Request paths such as /health, /ready, /live, /ping, or /healthz.
• Probe user agents such as kube-probe or ELB-HealthChecker.
• Successful status codes such as 200.
• Repeated requests at a fixed interval.
• Requests generated by infrastructure rather than end users.

​

Example

{
  "@timestamp": "2024-01-15T10:30:00Z",
  "service.name": "checkout-api",
  "http.method": "GET",
  "http.target": "/health",
  "http.status_code": 200,
  "http.user_agent": "kube-probe/1.28"
}

id: drop-health-checks-checkout-api
name: Drop health check logs from checkout-api
description: Drop Kubernetes probe requests to health endpoints.
log:
  match:
    - resource_attribute: service.name
      exact: checkout-api
    - log_attribute: http.target
      regex: "^/(health|ready|live|ping)"
    - log_attribute: http.status_code
      exact: "200"
  keep: none

​

Recommended enforcement

​

Detection notes

• Tero identifies health check logs by request path, user agent, and status code.
• Tero drops successful probes and keeps failed ones; they can show when a service became unhealthy.
• Scope path matching to health endpoints so the policy doesn’t drop normal user traffic.