analyzing-kubernetes-audit-logs

Name: analyzing-kubernetes-audit-logs
Author: killvxk

34stars9forks

How to install analyzing-kubernetes-audit-logs?

killvxk/cybersecurity-skills-zh/analyzing-kubernetes-audit-logs

$npx -y skills add killvxk/cybersecurity-skills-zh --skill analyzing-kubernetes-audit-logs

Installs into the current project.

Summary

解析 Kubernetes API server 审计日志（JSON lines 格式），检测 exec 进入 Pod、 Secret 访问、RBAC 修改、特权 Pod 创建以及匿名 API 访问行为。从审计事件模式构建威胁检测规则。适用于调查 Kubernetes 集群入侵或构建 k8s 专用 SIEM 检测规则。

Files · 1

View on GitHub

SKILL.md

1	# 分析 Kubernetes 审计日志
2
3	## 说明
4
5	解析 Kubernetes 审计日志文件（JSON lines 格式），检测安全相关事件，
6	包括未授权访问、权限提升（privilege escalation）和数据外泄（exfiltration）。
7
8	```python
9	import json
10
11	with open("/var/log/kubernetes/audit.log") as f:
12	for line in f:
13	event = json.loads(line)
14	verb = event.get("verb")
15	resource = event.get("objectRef", {}).get("resource")
16	user = event.get("user", {}).get("username")
17	if verb == "create" and resource == "pods/exec":
18	print(f"Pod exec by {user}")
19	```
20
21	需检测的关键事件：
22	1. pods/exec 和 pods/attach（进入容器 shell）
23	2. secrets 访问（get/list/watch）
24	3. clusterrolebindings 创建（RBAC 权限提升）
25	4. 特权 Pod 创建
26	5. 匿名或 system:unauthenticated 访问
27
28	## 示例
29
30	```python
31	# 检测 secret 枚举
32	if verb in ("get", "list") and resource == "secrets":
33	print(f"Secret access: {user} -> {event['objectRef'].get('name')}")
34	```

People who liked this also viewed

6 picks

Type

analyzing-kubernetes-audit-logs

34stars9forks

View on GitHub

How to install analyzing-kubernetes-audit-logs?

killvxk/cybersecurity-skills-zh/analyzing-kubernetes-audit-logs

$npx -y skills add killvxk/cybersecurity-skills-zh --skill analyzing-kubernetes-audit-logs

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# 分析 Kubernetes 审计日志
2
3	## 说明
4
5	解析 Kubernetes 审计日志文件（JSON lines 格式），检测安全相关事件，
6	包括未授权访问、权限提升（privilege escalation）和数据外泄（exfiltration）。
7
8	```python
9	import json
10
11	with open("/var/log/kubernetes/audit.log") as f:
12	for line in f:
13	event = json.loads(line)
14	verb = event.get("verb")
15	resource = event.get("objectRef", {}).get("resource")
16	user = event.get("user", {}).get("username")
17	if verb == "create" and resource == "pods/exec":
18	print(f"Pod exec by {user}")
19	```
20
21	需检测的关键事件：
22	1. pods/exec 和 pods/attach（进入容器 shell）
23	2. secrets 访问（get/list/watch）
24	3. clusterrolebindings 创建（RBAC 权限提升）
25	4. 特权 Pod 创建
26	5. 匿名或 system:unauthenticated 访问
27
28	## 示例
29
30	```python
31	# 检测 secret 枚举
32	if verb in ("get", "list") and resource == "secrets":
33	print(f"Secret access: {user} -> {event['objectRef'].get('name')}")
34	```

People who liked this also viewed

6 picks

Type