Kubernetes Audit Log Gaps Can Hinder Detection and Forensics

Article Details

Defense Focus

Improve Kubernetes threat detection and forensic coverage by consistently enabling and centralizing audit logs, accounting for provider-specific formats and policy gaps, and augmenting audit data with other telemetry.

Detection Methods

• Configure Kubernetes audit logging consistently across clusters and send events to a centralized SIEM.
• Use detection rules for suspicious Kubernetes API activity, including workload creation by anonymous or unauthenticated users; adapt rules to provider-specific log formats or normalize events first.
• Correlate audit events with dynamic admission-controller state-change monitoring, cloud-specific logs, and network telemetry.
• Use audit events to investigate the actor, source IP, action, resource, and event timestamp.

Data Sources

• Kubernetes audit logs
• Dynamic admission-controller events
• AWS CloudTrail
• Azure Activity Logs
• VPC Flow Logs
• Network Policies
• Network behavior monitoring

Rule Types

• Rego detection rules for Kubernetes workload creation by anonymous or unauthenticated users

Platforms

• SIEM

Defensive Actions

• Verify audit logging is enabled across all managed and self-hosted clusters; some providers disable it by default.
• Assess provider-specific audit policy coverage and identify events or fields that may be omitted.
• Normalize provider-specific audit events where possible, or maintain rules compatible with each format.
• Account for ingestion latency and storage and query costs when centralizing high-volume logs.
• Augment audit logs with admission-controller, cloud infrastructure, and network telemetry to improve detection and investigations.