Skip to content
Kubernetes Forensics
Blog

This tool is not affiliated with, endorsed by or sponsored by The Linux Foundation, the Cloud Native Computing Foundation (CNCF) or the Kubernetes project. Kubernetes and K8s are registered trademarks of The Linux Foundation. EKS, GKE, AKS and other names are trademarks of their respective owners.

Series

Kubernetes incident response

3 posts in this series. Read them in order or jump to any one.

  1. Kubernetes Incident Response with API Server Audit Logs

    A practitioner's Kubernetes incident response guide: the audit log evidence to collect, the questions to answer, the attack patterns to hunt and how to contain.

  2. How to Analyze Kubernetes Audit Logs in Your Browser

    Step-by-step Kubernetes audit log analysis with a free in-browser tool: load EKS, GKE, AKS or raw exports, read the verdict, findings, timeline and entities.

  3. Kubernetes Attack Walkthrough: A Fictional Incident

    A fictional Kubernetes incident, step by step in the audit log: exposed dashboard token, can-i recon, secret theft, privileged DaemonSet, cluster-admin, XMRig.

All posts in this series

Kubernetes Incident Response with API Server Audit Logs
A practitioner's Kubernetes incident response guide: the audit log evidence to collect, the questions to answer, the attack patterns to hunt and how to contain.
incident-responseaudit-logsdetectionmitre-attack
How to Analyze Kubernetes Audit Logs in Your Browser
Step-by-step Kubernetes audit log analysis with a free in-browser tool: load EKS, GKE, AKS or raw exports, read the verdict, findings, timeline and entities.
audit-logsincident-responsedetectiontutorial
Kubernetes Attack Walkthrough: A Fictional Incident
A fictional Kubernetes incident, step by step in the audit log: exposed dashboard token, can-i recon, secret theft, privileged DaemonSet, cluster-admin, XMRig.
incident-responseaudit-logsdetectiontutorial

This tool is not affiliated with, endorsed by or sponsored by The Linux Foundation, the Cloud Native Computing Foundation (CNCF) or the Kubernetes project. Kubernetes and K8s are registered trademarks of The Linux Foundation. EKS, GKE, AKS and other names are trademarks of their respective owners.