Stats
Actions
Tags
Parses Kubernetes API server audit logs (JSON lines) to detect Pod execs, Secret access, RBAC modifications, privileged Pod creation, and anonymous API access. Builds threat detection rules for cluster intrusion investigations or k8s SIEM.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersecurity-skills-zh:analyzing-kubernetes-audit-logsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
解析 Kubernetes 审计日志文件（JSON lines 格式），检测安全相关事件，
解析 Kubernetes 审计日志文件（JSON lines 格式），检测安全相关事件， 包括未授权访问、权限提升（privilege escalation）和数据外泄（exfiltration）。
import json
with open("/var/log/kubernetes/audit.log") as f:
for line in f:
event = json.loads(line)
verb = event.get("verb")
resource = event.get("objectRef", {}).get("resource")
user = event.get("user", {}).get("username")
if verb == "create" and resource == "pods/exec":
print(f"Pod exec by {user}")
需检测的关键事件：
# 检测 secret 枚举
if verb in ("get", "list") and resource == "secrets":
print(f"Secret access: {user} -> {event['objectRef'].get('name')}")
npx claudepluginhub killvxk/cybersecurity-skills-zhParses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret enumeration, RBAC changes, privileged pods, and anonymous access. Use for cluster compromise investigations or building k8s SIEM rules.
Parses Kubernetes API server audit logs (JSON lines) to detect pod execs, secret access, RBAC modifications, privileged pod creation, and anonymous access. Builds threat detection rules for cluster compromise investigations and SIEM.
Parses Kubernetes API server audit logs to detect exec-into-pod, secret access, RBAC changes, privileged pods, and anonymous API access. Builds threat detection rules from audit patterns.