Parses Kubernetes API server audit logs (JSON lines) to detect Pod execs, Secret access, RBAC modifications, privileged Pod creation, and anonymous API access. Builds threat detection rules for cluster intrusion investigations or k8s SIEM.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
解析 Kubernetes 审计日志文件（JSON lines 格式），检测安全相关事件，
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules for cluster investigations.
Parses Kubernetes API server audit logs (JSON lines) to detect pod execs, secret access, RBAC modifications, privileged pod creation, and anonymous access. Builds threat detection rules for cluster compromise investigations and SIEM.
Audits Kubernetes cluster RBAC using kubectl, rbac-tool, KubiScan, Kubeaudit to identify permissive roles, wildcard permissions, dangerous bindings, service account abuse, and escalation paths.
Share bugs, ideas, or general feedback.
解析 Kubernetes 审计日志文件（JSON lines 格式），检测安全相关事件， 包括未授权访问、权限提升（privilege escalation）和数据外泄（exfiltration）。
import json
with open("/var/log/kubernetes/audit.log") as f:
for line in f:
event = json.loads(line)
verb = event.get("verb")
resource = event.get("objectRef", {}).get("resource")
user = event.get("user", {}).get("username")
if verb == "create" and resource == "pods/exec":
print(f"Pod exec by {user}")
需检测的关键事件：
# 检测 secret 枚举
if verb in ("get", "list") and resource == "secrets":
print(f"Secret access: {user} -> {event['objectRef'].get('name')}")