analyzing-kubernetes-audit-logs

1# Analyzing Kubernetes Audit Logs
2 
3 
4## When to Use
5 
6- When investigating security incidents that require analyzing kubernetes audit logs
7- When building detection rules or threat hunting queries for this domain
8- When SOC analysts need structured procedures for this analysis type
9- When validating security monitoring coverage for related attack techniques
10 
11## Prerequisites
12 
13- Familiarity with container security concepts and tools
14- Access to a test or lab environment for safe execution
15- Python 3.8+ with required dependencies installed
16- Appropriate authorization for any testing activities
17 
18## Instructions
19 
20Parse Kubernetes audit log files (JSON lines format) to detect security-relevant
21events including unauthorized access, privilege escalation, and data exfiltration.
22 
23```python
24import json
25 
26with open("/var/log/kubernetes/audit.log") as f:
27    for line in f:
28        event = json.loads(line)
29        verb = event.get("verb")
30        resource = event.get("objectRef", {}).get("resource")
31        user = event.get("user", {}).get("username")
32        if verb == "create" and resource == "pods/exec":
33            print(f"Pod exec by {user}")
34```
35 
36Key events to detect:
371. pods/exec and pods/attach (shell into containers)
382. secrets access (get/list/watch)
393. clusterrolebindings creation (RBAC escalation)
404. Privileged pod creation
415. Anonymous or system:unauthenticated access
42 
43## Examples
44 
45```python
46# Detect secret enumeration
47if verb in ("get", "list") and resource == "secrets":
48…