About

Imported from mukul975/anthropic-cybersecurity-skills (skills/analyzing-kubernetes-audit-logs/SKILL.md) via skills.sh. Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill analyzing-kubernetes-audit-logs. Copyright stays with the author (Apache-2.0).

Analyzing Kubernetes Audit Logs

Name: analyzing-kubernetes-audit-logs
Author: mukul975

When to Use

When investigating security incidents that require analyzing kubernetes audit logs
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with container security concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Parse Kubernetes audit log files (JSON lines format) to detect security-relevant events including unauthorized access, privilege escalation, and data exfiltration.

import json

with open("/var/log/kubernetes/audit.log") as f:
    for line in f:
        event = json.loads(line)
        verb = event.get("verb")
        resource = event.get("objectRef", {}).get("resource")
        user = event.get("user", {}).get("username")
        if verb == "create" and resource == "pods/exec":
            print(f"Pod exec by {user}")

Key events to detect:

pods/exec and pods/attach (shell into containers)
secrets access (get/list/watch)
clusterrolebindings creation (RBAC escalation)
Privileged pod creation
Anonymous or system:unauthenticated access

Examples

# Detect secret enumeration
if verb in ("get", "list") and resource == "secrets":
    print(f"Secret access: {user} -> {event['objectRef'].get('name')}")

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-analyzing-kubern-31a851/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-analyzing-kubern-31a851.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-analyzing-kubern-31a851",
  "kind": "skill",
  "name": "analyzing-kubernetes-audit-logs",
  "description": "Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use when investigating a suspected cluster compromise, reconstructing what an attacker did through the API server, or writing Kubernetes-specific detection content. Keywords: audit policy, audit log, kube-apiserver, exec into pod, RBAC change, anonymous access, detection rules. Do not use for syscall-level detection inside a running container - use detecting-container-runtime-threats-with-falco. '",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "kubernetes-security",
      "container-security",
      "audit-log-analysis",
      "rbac",
      "privilege-escalation",
      "k8s-api-server",
      "threat-detection",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use when investigating a suspected cluster compromise, reconstructing what an attacker did through the API server, or writing Kubernetes-specific detection content. Keywords: audit policy, audit log, kube-apiserver, exec into pod, RBAC change, anonymous access, detection rules. Do not use for syscall-level detection inside a running container - use detecting-container-runtime-threats-with-falco. '"
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/analyzing-kubernetes-audit-logs/SKILL.md",
      "ref": "HEAD",
      "url": "https://www.skills.sh/mukul975/anthropic-cybersecurity-skills/analyzing-kubernetes-audit-logs",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/analyzing-kubernetes-audit-logs/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Analyzing Kubernetes Audit Logs\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing kubernetes audit logs\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with container security concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n##",
  "cost": {
    "context_tokens": 392
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-analyzing-kubern-31a851/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.