Анализ аудит-логов Kubernetes для выявления угроз

★ 8.4 · security

analyzing-kubernetes-audit-logs is a Claude Code skill that parses Kubernetes API server audit logs in JSON lines format to surface security-relevant events across a cluster. It covers five threat categories: container exec sessions (pods/exec and pods/attach), secret enumeration via get/list/watch verbs, clusterrolebinding creation indicating RBAC privilege escalation, privileged pod creation, and anonymous or system:unauthenticated API access. Detected patterns are translated into threat detection rules suitable for k8s-specific SIEM queries. The skill targets SOC analysts and security engineers investigating cluster compromise or building proactive threat-hunting coverage — Python 3.8+ and access to audit log files are required.