analyzing-kubernetes-audit-logs

name	analyzing-kubernetes-audit-logs
description	Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns. Use when investigating Kubernetes cluster compromise or building k8s-specific SIEM detection rules.
domain	cybersecurity
subdomain	container-security
tags	["analyzing","kubernetes","audit","logs"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01"]

Analyzing Kubernetes Audit Logs

When to Use

• When investigating security incidents that require analyzing kubernetes audit logs
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Detection Gaps & Validation

• level: Metadata hides the payload: at Metadata level the requestObject is dropped, so privileged-pod detection (securityContext.privileged, hostPID, capability adds) and secret values are invisible. Use level: RequestResponse for pods create/update and for clusterrolebindings to see the escalation body.
• Subresources are separate: pods/exec and pods/attach are distinct from pods - a rule matching only resource == "pods" misses every shell-in. Match the subresource explicitly.
• omitStages: ["RequestReceived"] combined with a low default level can silently discard events; confirm your policy emits the ResponseComplete stage for sensitive verbs.
• Anonymous access: match user.username == "system:anonymous" or group system:unauthenticated, not just missing users.
• Secret enumeration at Metadata shows the verb/name but not which keys were read - escalate to Request level for the secrets you care about.
• How to validate the rule fires: run kubectl exec -it <pod> -- sh and kubectl get secret <name> -o yaml against a test namespace, then grep the audit log for pods/exec and secrets events with your username. If nothing appears, the audit policy level is too low or the stage is omitted.

Prerequisites

• Familiarity with container security concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Instructions

Parse Kubernetes audit log files (JSON lines format) to detect security-relevant events including unauthorized access, privilege escalation, and data exfiltration.