---
name: Analyzing Kubernetes Audit Logs
slug: analyzing-kubernetes-audit-logs
category: Quality
description: Analyzing Kubernetes Audit Logs parses audit events to find suspicious API activity such as exec, secret access, and RBAC changes. Use it to build timelines, detection rules, and SOC handoff notes for Kubernetes investigations.
github: "https://github.com/devton/agentic-workflow-blueprint/tree/main/workflows/analyzing-kubernetes-audit-logs"
stars: 66
forks: 4
install: "npx degit https://github.com/devton/agentic-workflow-blueprint/tree/main/workflows/analyzing-kubernetes-audit-logs ~/.claude/skills/analyzing-kubernetes-audit-logs"
installs_to: ~/.claude/skills/analyzing-kubernetes-audit-logs
source_path: workflows/analyzing-kubernetes-audit-logs/SKILL.md
collection_size: 26
category_size: 1354
collection_url: "https://dirskills.com/collections/devton/agentic-workflow-blueprint"
added: 2026-08-12T04:43:58.486Z
last_synced: 2026-08-12T04:43:58.486Z
canonical_url: "https://dirskills.com/skills/analyzing-kubernetes-audit-logs"
---

# Analyzing Kubernetes Audit Logs

Analyzing Kubernetes Audit Logs parses audit events to find suspicious API activity such as exec, secret access, and RBAC changes. Use it to build timelines, detection rules, and SOC handoff notes for Kubernetes investigations.

**Install:**

```bash
npx degit https://github.com/devton/agentic-workflow-blueprint/tree/main/workflows/analyzing-kubernetes-audit-logs ~/.claude/skills/analyzing-kubernetes-audit-logs
```

## README

## agentic-workflows-blueprint.workflow.analyzing-kubernetes-audit-logs

### Goal

Analyze Kubernetes API audit logs to detect high-risk behaviors (privilege escalation, secret access, lateral movement patterns) and produce actionable detection and response artifacts.

### Scope

- Applies to: Kubernetes API server audit event streams and exported log files.
- Does not cover: host-level syscall telemetry or network packet-level forensics.

### Triggers

- "Analyze Kubernetes audit logs"
- "Investigate suspicious Kubernetes API activity"
- "Create detections for exec/secrets/RBAC abuse"
- "Validate SOC coverage for Kubernetes attack techniques"

### Inputs

- `auditLogSource`: file path, stream, or SIEM index containing audit events
- `timeWindow`: interval under investigation
- `clusterContext`: cluster/environment and namespace scope
- `detectionProfile`: event patterns and severity mapping
- `knownIdentities` (optional): approved users/service accounts for suppression baselines
- `incidentContext` (optional): case ID, IOC list, and investigation hypotheses

### Invariants

- Parsing logic must preserve original event fields for traceability.
- High-risk event classes are explicitly monitored (`pods/exec`, secret access, RBAC mutations, privileged pod creation, unauthenticated access).
- Detection outputs must distinguish confirmed suspicious activity from expected admin operations.
- Investigation artifacts must be suitable for SOC handoff and replay.

### Procedure

1. **Ingest and normalize logs**
   - Parse JSON-lines audit entries and validate schema consistency.
   - Normalize key fields (verb, resource, user, namespace, source IP, response code, stage).

2. **Apply high-risk detection rules**
   - Detect shell access (`pods/exec`, `pods/attach`), secret enumeration/access, RBAC change events, and privileged workload creations.
   - Detect anonymous/unauthenticated API access and unusual identity behaviors.

3. **Correlate and enrich**
   - Correlate events by user, namespace, workload, and time sequence.
   - Enrich with identity criticality, known admin windows, and threat indicators.

4. **Classify findings**
   - Rank detections by severity and confidence.
   - Separate expected operational actions from anomalous activity.

5. **Generate detection artifacts**
   - Produce rule candidates or SIEM queries for recurring patterns.
   - Document event signatures and false-positive tuning guidance.

6. **Incident handoff and response support**
   - Build timeline of key suspicious actions.
   - Provide recommended containment/investigation next steps.

### Outputs

- Structured audit analysis report with severity-ranked findings.
- Event timeline highlighting suspicious activity chains.
- Detection rule/query package for SOC/SIEM integration.
- Tuning notes and suppression candidates for noisy expected behavior.

### Review gate

- [ ] Core high-risk event categories are covered by explicit detections.
- [ ] Findings include enough context for analyst action.
- [ ] Event evidence is traceable back to raw audit records.
- [ ] Detection package is reproducible and suitable for automation.
- [ ] False-positive handling guidance is documented.

### References

- `../../SKILL.md`
- `../triaging-vulnerabilities-with-ssvc-framework/SKILL.md`
- `../review/SKILL.md`
- [Interactive HTML View](./README.html)