Analyzing Kubernetes Audit Logs
FreeDetect security issues in Kubernetes audit logs.
Free · Opens the source repo
What Analyzing Kubernetes Audit Logs does
The Analyzing Kubernetes Audit Logs skill is designed for security professionals who need to scrutinize Kubernetes API server audit logs for potential security threats. This skill parses logs formatted as JSON lines, enabling users to identify key events such as unauthorized access attempts, privilege escalations, and data exfiltration activities. By leveraging this skill, users can build tailored threat detection rules based on specific patterns observed in the audit logs. This is particularly beneficial for Security Operations Center (SOC) analysts and incident responders tasked with investigating security incidents or validating the effectiveness of their security monitoring solutions.
The skill focuses on detecting critical events that may indicate a compromise within a Kubernetes cluster. It identifies actions such as executing commands in pods, accessing sensitive secrets, and creating or modifying Role-Based Access Control (RBAC) settings. These capabilities are essential for maintaining the integrity and security of Kubernetes environments, especially in organizations where container orchestration plays a pivotal role in application deployment and management.
To use this skill effectively, users should be familiar with container security concepts and have access to a controlled environment for testing. The skill requires Python 3.8 or higher and the necessary dependencies to be installed. With straightforward instructions and code examples provided, users can quickly implement the skill to analyze their audit logs and respond to potential threats with confidence.
Overall, this skill is a valuable addition for any security-focused team working with Kubernetes, providing structured procedures for audit log analysis and enhancing their threat detection capabilities.
When to use it
Use this skill when investigating security incidents in Kubernetes or when creating detection rules for security monitoring.
When not to use it
This skill may not be suitable for environments without Kubernetes or for general-purpose log analysis outside of Kubernetes security.
What you can build with it
Investigating a Security Incident
Use this skill to analyze audit logs after a suspected security breach in your Kubernetes environment.
Building Detection Rules
Leverage the skill to create specific detection rules for your security monitoring systems based on observed log patterns.
Validating Security Coverage
Employ this skill to assess whether your current security monitoring effectively covers potential attack vectors in Kubernetes.
How to install Analyzing Kubernetes Audit Logs
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/analyzing-kubernetes-audit-logs --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Analyzing Kubernetes Audit Logs
When to Use
- When investigating security incidents that require analyzing kubernetes audit logs
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Familiarity with container security concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Instructions
Parse Kubernetes audit log files (JSON lines format) to detect security-relevant events including unauthorized access, privilege escalation, and data exfiltration.
import json
with open("/var/log/kubernetes/audit.log") as f:
for line in f:
event = json.loads(line)
verb = event.get("verb")
resource = event.get("objectRef", {}).get("resource")
user = event.get("user", {}).get("username")
if verb == "create" and resource == "pods/exec":
print(f"Pod exec by {user}")
Key events to detect:
- pods/exec and pods/attach (shell into containers)
- secrets access (get/list/watch)
- clusterrolebindings creation (RBAC escalation)
- Privileged pod creation
- Anonymous or system:unauthenticated access
Examples
# Detect secret enumeration
if verb in ("get", "list") and resource == "secrets":
print(f"Secret access: {user} -> {event['objectRef'].get('name')}")
Frequently asked questions about Analyzing Kubernetes Audit Logs
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.