Skip to content
Agentmart
Submit a tool

analyzing-kubernetes-audit-logs

解析 Kubernetes API server 审计日志（JSON lines 格式），检测 exec 进入 Pod、 Secret 访问、RBAC 修改、特权 Pod 创建以及匿名 API 访问行为。 从审计事件模式构建威胁检测规则。适用于调查 Kubernetes 集群入侵 或构建 k8s 专用 SIEM…

Skill by killvxk

IndexedApache-2.0★ 57
Write a review

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/killvxk-analyzing-kubernetes-audit-logs

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

解析 Kubernetes API server 审计日志（JSON lines 格式），检测 exec 进入 Pod、 Secret 访问、RBAC 修改、特权 Pod 创建以及匿名 API 访问行为。 从审计事件模式构建威胁检测规则。适用于调查 Kubernetes 集群入侵 或构建 k8s 专用 SIEM 检测规则。

Use cases: backend, devops, security

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools
No tools found
Secrets
None asked for
Install scripts
None found
Runs as
Python package

Network hosts it talks to 1

  • codeload.github.com · found in install command

Files it touches

  • ~/.claude/skills/analyzing-kubernetes-audit-logs

What's inside

Skill name
analyzing-kubernetes-audit-logs
Description
解析 Kubernetes API server 审计日志（JSON lines 格式），检测 exec 进入 Pod、 Secret 访问、RBAC 修改、特权 Pod 创建以及匿名 API 访问行为。 从审计事件模式构建威胁检测规则。适用于调查 Kubernetes 集群入侵 或构建 k8s 专用 SIEM 检测规则。
License
Apache-2.0
Instructions
36 lines in SKILL.md · view on GitHub

Before installing

  • Ships executable scripts

Files (4)

  • LICENSE
  • SKILL.md
  • api-reference.md · references/
  • agent.py · scripts/

SKILL.md (first lines)

# 分析 Kubernetes 审计日志

## 说明

解析 Kubernetes 审计日志文件（JSON lines 格式），检测安全相关事件，
包括未授权访问、权限提升（privilege escalation）和数据外泄（exfiltration）。

```python
import json

with open("/var/log/kubernetes/audit.log") as f:
    for line in f:
        event = json.loads(line)
        verb = event.get("verb")
        resource = event.get("objectRef", {}).get("resource")
        user = event.get("user", {}).get("username")
        if verb == "create" and resource == "pods/exec":
            print(f"Pod exec by {user}")
```

需检测的关键事件：
1. pods/exec 和 pods/attach（进入容器 shell）
2. secrets 访问（get/list/watch）
3. clusterrolebindings 创建（RBAC 权限提升）
4. 特权 Pod 创建
5. 匿名或 system:unauthenticated 访问

## 示例

```python
# 检测 secret 枚举
if verb in ("get", "list") and resource == "secrets":
    print(f"Secret access: {user} -> {event['objectRef'].get('name')}")
```

From killvxk/cybersecurity-skills-zh, Apache-2.0.

More from killvxk/cybersecurity-skills-zh

Signals

Stars
57
Forks
14
Open issues
1
Last commit (this folder)
Mar 17, 2026 (7 months ago)

From GitHub (fetched Oct 24, 2026).

Details

License
Apache-2.0
Repository
github.com/killvxk/cybersecurity-skills-zh
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
GitHubgithub-graphql

More from killvxk

Cite this page

analyzing-kubernetes-audit-logs skill. Agent Mart. https://agentmart.dev/skills/killvxk-analyzing-kubernetes-audit-logs (last updated 2026-10-24)