<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: monitoring-kubernetes-audit-logs
description: >-
  Configure and monitor Kubernetes API server audit logs to detect unauthorized
  access, privilege escalation, secret exfiltration, and suspicious API calls
  using audit policies, log forwarding, and SIEM integration.
domain: cybersecurity
subdomain: container-security
tags:
  - audit-logs
  - kubernetes-api
  - siem
  - threat-detection
  - compliance
  - elk
  - splunk
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1613"]
---

# Monitoring Kubernetes Audit Logs

## Overview

Kubernetes audit logs record all API server requests, providing a chronological
record of cluster activity essential for threat detection, incident investigation,
and compliance. This skill covers configuring audit policies at appropriate
verbosity levels, forwarding logs to SIEM platforms, building detection rules
for suspicious API calls, and correlating audit events during incident response.

Mode: `[MODE: BLUE]` — Detection and monitoring.

## Prerequisites

| Requirement | Details |
|---|---|
| Kubernetes cluster with API server access for audit configuration | Required |
| Audit logging enabled (self-managed) or configured (EKS/AKS/GKE) | Required |
| SIEM platform (Splunk, Elastic, or similar) for log aggregation | Required |
| Fluentd/Fluent Bit for log forwarding | Required |

## Key Concepts

### Core Techniques

Refer to the parent container-security skill for detailed command references and
attack/defense techniques relevant to this area.

```bash
# Run the automated audit agent
node scripts/agent.js --action audit --output /tmp/monitoring-kubernetes-audit-logs-audit.json
```

### Automation

The `scripts/agent.js` tool provides automated scanning and analysis capabilities.
See `references/api-reference.md` for complete tool and API documentation.

## Workflow

### Step 1: Collect Data

```bash
node scripts/agent.js --action audit --output /tmp/monitoring-kubernetes-audit-logs-results.json
```

### Step 2: Review Findings

```bash
cat /tmp/monitoring-kubernetes-audit-logs-results.json | jq '.findings[] | select(.severity == "critical" or .severity == "high")'
```

### Step 3: Remediate

Address findings by severity, starting with critical items. Re-run the audit
to verify remediation effectiveness.

## Detection

```yaml
title: Kubernetes Audit Logs Detection
id: a30588a2-24c7-4494-b272-0eabe24be65b
status: experimental
description: Detects suspicious activity related to monitoring kubernetes audit logs techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1613
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Kubernetes Audit Logs Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1613 |

## Verification

- [ ] Automated scan completed with zero critical findings
- [ ] All high-severity findings have remediation plans
- [ ] Configuration changes validated in staging before production
- [ ] Detection rules deployed and alerting verified
- [ ] Documentation updated with current security posture

## References

- [Kubernetes Audit Logging](https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/)
- [EKS Control Plane Logging](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html)
- [CIS Kubernetes Benchmark 3.2 — Logging](https://www.cisecurity.org/benchmark/kubernetes)
