How to Export and Review Kubernetes Audit Logs

Summary

Guide explains where to enable and export Kubernetes API audit logs on self-managed clusters, EKS, AKS and GKE, and how to review suspicious activity. Logging must be enabled in advance; AKS kube-audit-admin omits read-only calls.

Key points

Audit-log locations differ across self-managed clusters, EKS, AKS and GKE; self-managed clusters and EKS require audit logging to be enabled.
If logging was not enabled, past audit events cannot be exported. The audit policy level determines whether logs contain request bodies or only metadata.
The guide provides platform-specific export examples using local audit files, CloudWatch Logs, Log Analytics and Cloud Audit Logs.
Review for suspicious activity such as unexpected pod exec requests, new ClusterRoleBindings to cluster-admin, unusual secret reads and privileged pod settings.
Anonymous requests receiving successful responses and bursts of 403 errors from a service account are also highlighted for investigation.
AKS kube-audit-admin excludes read-only get and list calls, which can hide secret reads; collecting kube-audit may be necessary.
The guide recommends sanitizing usernames, service-account names, source IPs, namespaces and object names before reviewing uploaded logs.

Article Details

Defense Focus: Enable and export Kubernetes API audit logs, then review them for suspicious access, privilege changes, and container activity.
Detection Methods: Review create requests to pods/exec for shell access inside running containers.
Identify ClusterRoleBinding creation that grants cluster-admin privileges.
Investigate get or list requests for secrets by unusual identities.
Flag pods configured with privileged, hostPath, or hostNetwork settings.
Investigate successful requests by system:anonymous and bursts of 403 responses from a service account.
Data Sources: Kubernetes API audit logs from self-managed control-plane files or managed-cluster logging services.
Audit records identifying the user, verb, object, response status, and—at higher policy levels—request bodies such as pod specifications.
Rotated audit-log files when the review period extends beyond the current file.
Rule Types: JSON Lines Kubernetes audit records.
CloudWatch Logs event filtering with JSON extraction.
Log Analytics query filtering AKSAuditAdmin by TimeGenerated.
Cloud Audit Logs resource and timestamp filters.
Platforms: Self-managed Kubernetes control planes.
Managed Kubernetes control planes.
Defensive Actions: Check whether audit logging is enabled; enable it for future collection if it was off, since past logs cannot be exported retroactively.
Verify the audit policy and log path on self-managed control planes, and enable the audit log type or category in managed-cluster settings.
Choose an audit policy detail level appropriate to the investigation: Request or RequestResponse can expose request bodies that Metadata-level logging omits.
Account for AKS kube-audit-admin excluding read-only get and list requests; collect kube-audit when secret-read visibility is needed.
Include rotated files and unwrap CloudWatch event messages before analyzing them.
Review data sanitization before uploading logs to LogTotal.

MITRE ATT&CK

T1552.007 · Container APIThe article identifies reading credentials through the container API, including unusual get or list requests for secrets.T1609 · Container Administration CommandThe article identifies exec into running containers as an activity detectable in Kubernetes audit data.T1610 · Deploy ContainerThe article identifies deploying rogue containers as an activity detectable in Kubernetes audit data.

Vendors

Amazon Web Servicesaws logs filter-log-events --log-group-name /aws/eks/my-cluster/cluster \

Products

AKSOn EKS, they go to CloudWatch Logs, on AKS to a Log Analytics workspace or storage account, and on GKE to Cloud Audit Logs.Cloud Audit LogsOn EKS, they go to CloudWatch Logs, on AKS to a Log Analytics workspace or storage account, and on GKE to Cloud Audit Logs.CloudWatch LogsOn EKS, they go to CloudWatch Logs, on AKS to a Log Analytics workspace or storage account, and on GKE to Cloud Audit Logs.EKSOn EKS, they go to CloudWatch Logs, on AKS to a Log Analytics workspace or storage account, and on GKE to Cloud Audit Logs.GKEOn EKS, they go to CloudWatch Logs, on AKS to a Log Analytics workspace or storage account, and on GKE to Cloud Audit Logs.KubernetesWhere Kubernetes audit logs live depends on who runs your control plane.Log AnalyticsOn EKS, they go to CloudWatch Logs, on AKS to a Log Analytics workspace or storage account, and on GKE to Cloud Audit Logs.LogTotalUpload, sanitize and review in LogTotal Prime CorePrime Core has 93 detection rules for Kubernetes audit data, mapped to 220 MITRE ATT&CK techniques.