Hi!

The following table lists the alerts that were deprecated:

Alert name	Description	Tactics	Severity
Docker build operation detected on a Kubernetes node (VM_ImageBuildOnNode)	Machine logs indicate a build operation of a container image on a Kubernetes node. While this behavior might be legitimate, attackers might build their malicious images locally to avoid detection.	Defense Evasion	Low
Suspicious request to Kubernetes API (VM_KubernetesAPI)	Machine logs indicate that a suspicious request was made to the Kubernetes API. The request was sent from a Kubernetes node, possibly from one of the containers running in the node. Although this behavior can be intentional, it might indicate that the node is running a compromised container.	LateralMovement	Medium
SSH server is running inside a container (VM_ContainerSSH)	Machine logs indicate that an SSH server is running inside a Docker container. While this behavior can be intentional, it frequently indicates that a container is misconfigured or breached.	Execution	Medium

These alerts are used to notify a user about suspicious activity connected to a Kubernetes cluster. The alerts will be replaced with matching alerts that are part of the Microsoft Defender for Cloud Container alerts (K8S.NODE_ImageBuildOnNode, K8S.NODE_ KubernetesAPI and K8S.NODE_ ContainerSSH) which will provide improved fidelity and comprehensive context to investigate and act on the alerts.

Source: https://learn.microsoft.com/en-us/azure/defender-for-cloud/release-notes

Maxime.