When an attacker gets a foothold in a cluster, the next move is usually to hop around pods, namespaces, or even nodes. Catching that hop is a staple of any Kubernetes security program, but the noise can drown you out. A single benign kubectl exec or a normal service‑mesh sidecar can set off the same alerts that a malicious container‑to‑container exfiltration would trigger. Below is a practical, repeatable walk‑through to cut the noise while still keeping the detection surface wide enough to catch the bad guys.