Analyzing Kubernetes Audit Logs

## agentic-workflows-blueprint.workflow.analyzing-kubernetes-audit-logs

### Goal

Analyze Kubernetes API audit logs to detect high-risk behaviors (privilege escalation, secret access, lateral movement patterns) and produce actionable detection and response artifacts.

### Scope

- Applies to: Kubernetes API server audit event streams and exported log files.
- Does not cover: host-level syscall telemetry or network packet-level forensics.

### Triggers

- "Analyze Kubernetes audit logs"
- "Investigate suspicious Kubernetes API activity"
- "Create detections for exec/secrets/RBAC abuse"
- "Validate SOC coverage for Kubernetes attack techniques"

### Inputs

- `auditLogSource`: file path, stream, or SIEM index containing audit events
- `timeWindow`: interval under investigation
- `clusterContext`: cluster/environment and namespace scope
- `detectionProfile`: event patterns and severity mapping
- `knownIdentities` (optional): approved users/service accounts for suppression baselines
- `incidentContext` (optional): case ID, IOC list, and investigation hypotheses

### Invariants

- Parsing logic must preserve original event fields for traceability.
- High-risk event classes are explicitly monitored (`pods/exec`, secret access, RBAC mutations, privileged pod creation, unauthenticated access).
- Detection outputs must distinguish confirmed suspicious activity from expected admin operations.
- Investigation artifacts must be suitable for SOC handoff and replay.

### Procedure

1. **Ingest and normalize logs**
   - Parse JSON-lines audit entries and validate schema consistency.
   - Normalize key fields (verb, resource, user, namespace, source IP, response code, stage).

2. **Apply high-risk detection rules**
   - Detect shell access (`pods/exec`, `pods/attach`), secret enumeration/access, RBAC change events, and privileged workload creations.
   - Detect anonymous/unauthenticated API access and unusual identity behaviors.

3. **Correlate and enrich**
   - Correlate events by user, namespace, workload, and time sequence.
   - Enrich with identity criticality, known admin windows, and threat indicators.

4. **Classify findings**
   - Rank detections by severity and confidence.
   - Separate expected operational actions from anomalous activity.

5. **Generate detection artifacts**
   - Produce rule candidates or SIEM queries for recurring patterns.
   - Document event signatures and false-positive tuning guidance.

6. **Incident handoff and response support**
   - Build timeline of key suspicious actions.
   - Provide recommended containment/investigation next steps.

### Outputs

- Structured audit analysis report with severity-ranked findings.
- Event timeline highlighting suspicious activity chains.
- Detection rule/query package for SOC/SIEM integration.
- Tuning notes and suppression candidates for noisy expected behavior.

### Review gate

- [ ] Core high-risk event categories are covered by explicit detections.
- [ ] Findings include enough context for analyst action.
- [ ] Event evidence is traceable back to raw audit records.
- [ ] Detection package is reproducible and suitable for automation.
- [ ] False-positive handling guidance is documented.

### References

- `../../SKILL.md`
- `../triaging-vulnerabilities-with-ssvc-framework/SKILL.md`
- `../review/SKILL.md`
- [Interactive HTML View](./README.html)