K8s审计日志分析
原名：analyzing-kubernetes-audit-logs
解析 Kubernetes API 服务器审计日志（JSON 行），检测进入 Pod 的 exec 操作。
- 分类
- 开发提效
- 版本
- v1.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 2
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-08-18
- TRACE 评分
- 3.4 / 5
内容概览
- When investigating security incidents that require analyzing kubernetes audit logs - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques - Familiarity with container security concepts and tools - Access to a test or lab environment for safe execution - Python 3.8+ with required dependencies installed - Appropriate authorization for any testing activities Parse Kubernetes audit log files (JSON lines format) to detect security-relevant events including unauthorized access, privilege escalation, and data exfiltration. Key events to detect: 1. pods/exec and pods/attach (shell into containers) 2. secrets access (get/list/watch) 3. clusterrolebindings creation (RBAC escalation) 4. Privileged pod creation 5. Anonymous or system:…