From asi
Parses Kubernetes API server audit logs (JSON lines) to detect pod execs, secret access, RBAC modifications, privileged pod creation, and anonymous access. Builds threat detection rules for cluster compromise investigations and SIEM.
npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- When investigating security incidents that require analyzing kubernetes audit logs
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules for cluster investigations.
Parses Kubernetes API server audit logs (JSON lines) to detect Pod execs, Secret access, RBAC modifications, privileged Pod creation, and anonymous API access. Builds threat detection rules for cluster intrusion investigations or k8s SIEM.
Audits Kubernetes RBAC configurations for overly permissive roles, wildcard permissions, dangerous bindings, service account abuse, and privilege escalation using kubectl, rbac-tool, KubiScan, Kubeaudit. For cluster security assessments on EKS, GKE, AKS.
Share bugs, ideas, or general feedback.
Parse Kubernetes audit log files (JSON lines format) to detect security-relevant events including unauthorized access, privilege escalation, and data exfiltration.
import json
with open("/var/log/kubernetes/audit.log") as f:
for line in f:
event = json.loads(line)
verb = event.get("verb")
resource = event.get("objectRef", {}).get("resource")
user = event.get("user", {}).get("username")
if verb == "create" and resource == "pods/exec":
print(f"Pod exec by {user}")
Key events to detect:
# Detect secret enumeration
if verb in ("get", "list") and resource == "secrets":
print(f"Secret access: {user} -> {event['objectRef'].get('name')}")