Posts tagged: #incident-response

The blind spots of Kubernetes audit logs: in-container activity, kubelet and etcd access, policy gaps, spoofable fields, and the evidence that fills them.

A fictional Kubernetes incident, step by step in the audit log: exposed dashboard token, can-i recon, secret theft, privileged DaemonSet, cluster-admin, XMRig.

Step-by-step Kubernetes audit log analysis with a free in-browser tool: load EKS, GKE, AKS or raw exports, read the verdict, findings, timeline and entities.

How to enable and export Kubernetes audit logs on Amazon EKS, Google GKE and Azure AKS: where they live, what the managed policy drops, and the export commands.

Write a Kubernetes audit policy that captures the evidence an investigation needs (exec, RBAC, workloads, tokens) without logging secrets or drowning in noise.

Field-by-field guide to the Kubernetes audit log format: stages, levels, user, sourceIPs, objectRef, responseStatus, annotations, and what matters in forensics.

A practitioner's Kubernetes incident response guide: the audit log evidence to collect, the questions to answer, the attack patterns to hunt and how to contain.