Skip to content
Kubernetes Forensics
Blog

This tool is not affiliated with, endorsed by or sponsored by The Linux Foundation, the Cloud Native Computing Foundation (CNCF) or the Kubernetes project. Kubernetes and K8s are registered trademarks of The Linux Foundation. EKS, GKE, AKS and other names are trademarks of their respective owners.

Blog

Kubernetes Audit Policy: What to Log for Forensics
Write a Kubernetes audit policy that captures the evidence an investigation needs (exec, RBAC, workloads, tokens) without logging secrets or drowning in noise.
audit-policyaudit-logsincident-response
Kubernetes Audit Log Format: Anatomy of an Audit Event
Field-by-field guide to the Kubernetes audit log format: stages, levels, user, sourceIPs, objectRef, responseStatus, annotations, and what matters in forensics.
audit-logsaudit-policyincident-response
Kubernetes Incident Response with API Server Audit Logs
A practitioner's Kubernetes incident response guide: the audit log evidence to collect, the questions to answer, the attack patterns to hunt and how to contain.
incident-responseaudit-logsdetectionmitre-attack

This tool is not affiliated with, endorsed by or sponsored by The Linux Foundation, the Cloud Native Computing Foundation (CNCF) or the Kubernetes project. Kubernetes and K8s are registered trademarks of The Linux Foundation. EKS, GKE, AKS and other names are trademarks of their respective owners.