Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use when investigating a suspected cluster compromise, reconstructing what an a

Analyzing Kubernetes Audit Logs When to Use When investigating security incidents that require analyzing kubernetes audit logs When building detection rules or threat hunting queries for this domain When SOC analysts need structured procedures for this analysis type When validating security monitoring coverage for related attack techniques Prerequisites Familiarity with container security concepts and tools Access to a test or lab environment for safe execution Python 3.8+ with required dependencies installed Appropriate authorization for any testing activities Instructions Parse Kubernetes audit log files (JSON lines format) to detect security relevant events including unauthorized access, privilege escalation, and data exfiltration. Key events to detect: 1. pods/exec and pods/attach (shell into containers) 2. secrets access (get/list/watch) 3. clusterrolebindings creation (RBAC escalation) 4. Privileged pod creation 5. Anonymous or system:unauthenticated access Examples

analyzing-kubernetes-audit-logs