网络安全 Analyzing Kubernetes Audit Logs

Model: minimax-m3 | ¥0.20/call

网络安全Claude Opus 4.7安全审计AnalyzingKubernetes

Analyzing Kubernetes Audit Logs：网络安全 skill: analyzing-kubernetes-audit-logs，适用于安全分析、取证与威胁排查场景。

Calls: 1

Skill Documentation

网络安全 Analyzing Kubernetes Audit Logs

摘要

Analyzing Kubernetes Audit Logs：网络安全 skill: analyzing-kubernetes-audit-logs，适用于安全分析、取证与威胁排查场景。

> 来源: mukul975/Anthropic-Cybersecurity-Skills (18k stars) — 网络安全专业技能集

> 原文件: skills/analyzing-kubernetes-audit-logs/SKILL.md

> 模型推荐: claude-opus-4-7 (安全分析深度推理)

这个 skill 是干嘛的

mukul975 整理的 100+ 个网络安全专业 skill,覆盖渗透测试 / 取证 / 威胁情报 / 合规审计 / 云安全 / 移动安全等领域。每个 skill 对应一个具体的安全分析任务。

michael 强调"skill 要有相应的指导功能,指导用户使用",所以加了下面两节让 Agent 和用户对接。

---

🤖 Agent 使用说明

1. 用户提到"分析 X 日志 / 取证 / 检测威胁 / 渗透测试 / 安全审计"时,触发对应 skill

2. skill 会按操作步骤一步步执行(取证镜像 / 解析日志 / 跑威胁情报 / etc.)

3. 涉及破坏性操作(rm/drop/format)前必须 ask user 确认

4. 完工后让 Agent 跑自检 step

5. 如果用户要求做"防御性分析" — 区分恶意代码审计 vs 渗透测试

👤 用户需要做什么?

1. 告诉 Agent 你要做什么(分析日志 / 取证 / 安全审计 / 渗透测试)

2. 如果需要提供文件/镜像/日志/哈希,按 Agent 提示提供

3. 涉及破坏性操作时明确告诉 Agent"继续"或"取消"

4. 全程 Agent 自动化,你只需提供数据 + 回答决策点

---

原 skill 内容(mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-kubernetes-audit-logs/SKILL.md,截断到 12k chars)

---

name: analyzing-kubernetes-audit-logs

description: 'Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod,

secret access, RBAC modifications, privileged pod creation, and anonymous API access.

Builds threat detection rules from audit event patterns. Use when investigating

Kubernetes cluster compromise or building k8s-specific SIEM detection rules.

domain: cybersecurity

subdomain: container-security

tags:

kubernetes-security
container-security
audit-log-analysis
rbac
privilege-escalation
k8s-api-server
threat-detection

version: '1.0'

author: mahipal

license: Apache-2.0

nist_csf:

PR.PS-01
PR.IR-01
ID.AM-08
DE.CM-01

mitre_attack:

T1610
T1613
T1078
T1552.007

---

Analyzing Kubernetes Audit Logs

When to Use

When investigating security incidents that require analyzing kubernetes audit logs
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with container security concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Parse Kubernetes audit log files (JSON lines format) to detect security-relevant

events including unauthorized access, privilege escalation, and data exfiltration.

import json

with open("/var/log/kubernetes/audit.log") as f:
    for line in f:
        event = json.loads(line)
        verb = event.get("verb")
        resource = event.get("objectRef", {}).get("resource")
        user = event.get("user", {}).get("username")
        if verb == "create" and resource == "pods/exec":
            print(f"Pod exec by {user}")

Key events to detect:

1. pods/exec and pods/attach (shell into containers)

2. secrets access (get/list/watch)

3. clusterrolebindings creation (RBAC escalation)

4. Privileged pod creation

5. Anonymous or system:unauthenticated access

Examples

# Detect secret enumeration
if verb in ("get", "list") and resource == "secrets":
    print(f"Secret access: {user} -> {event['objectRef'].get('name')}")

常见问题（FAQ）

使用「Analyzing Kube」这个 skill 能解决什么问题?

本 skill 专注于Analyzing Kube，网络安全 skill: analyzing-kubernetes-audit-logs。它将相关流程标准化，帮助用户更快拿到可靠结果，减少重复手工操作。

什么情况下适合使用「Analyzing Kube」?

当你需要在Analyzing Kubernetes Audit Logs相关工作中获得稳定、可复用的产出时最适合——无论是单次任务还是纳入日常工作流，都能直接调用。

使用「Analyzing Kube」前需要准备什么?

需要明确授权范围内的目标系统或样本文件，并准备隔离的分析环境（虚拟机/沙箱）。

FAQ