Guide · Agent skill

How to use the Kubernetes Audit Log Analysis agent skill

Updated 2026-10-29 · written with AI from the project's own documentation and checked against our catalogue data

This guide explains how to install and use the analyzing-kubernetes-audit-logs skill, an agent skill that lets an AI agent read Kubernetes API server audit logs and look for signs of compromise. It is written for security analysts, platform teams and detection engineers who have not used agent skills before. By the end you will know what the skill does, how to add it to your agent, how to ask for an analysis, and what to check before running it.

Kubernetes Audit Log Analysismukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill

Quick start

1Download the ZIP. Download the skill ZIP from this page.
2Unzip the skill. Unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder.
3Or upload it in the apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.
4Check prerequisites. Confirm Python 3.8+ is installed and you have access to a JSON lines audit log and authorization to analyze it.
5Make a request. Ask the agent in plain language to analyze your audit log for the events you care about.
6Review the findings. Check flagged events for user, verb, resource and timestamp before drawing conclusions.

What does the skill make the agent do?

Kubernetes records every request made to the API server in an audit log, showing who asked the cluster to do what. This skill teaches the agent to parse that log, which is stored as JSON lines, and to flag security-relevant events. The events it looks for are a shell opened inside a container (pods/exec and pods/attach), reads of secrets, creation of clusterrolebindings, creation of privileged pods, and anonymous or system:unauthenticated access.

Flags pod exec and attach events as HIGH severity
Flags secret get, list and watch activity as HIGH
Flags RBAC changes to clusterrolebindings and privileged pods as CRITICAL
Flags requests from system:anonymous as CRITICAL
Turns the observed patterns into SIEM detection rules
Helps reconstruct what an attacker did through the API server

Install the skill

Download the skill ZIP from this page and unzip it. The skill folder contains SKILL.md, scripts/agent.py and references/api-reference.md.

For a personal install, unzip the folder into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

Check what you need before you start

The skill requires Python 3.8 or newer and a Kubernetes API server audit log file in JSON lines format. The examples read /var/log/kubernetes/audit.log. You also need access to the audit logs and authorization to analyze them, because the logs contain sensitive data about who accessed what.

The skill runs scripts, so review them before running. It does not use the network.

Python 3.8+
Audit log file in JSON lines format
Access to the logs and written authorization to analyze them
Use a test or lab copy where possible

Ask the agent for an analysis

You do not need special syntax. Describe the task in plain language and name the log file. The agent will load the skill when your request matches its description, which covers investigating a suspected cluster compromise, reconstructing attacker activity through the API server, and writing Kubernetes-specific detection content.

Good requests name the goal, the log and the output you want.

"Analyze /var/log/kubernetes/audit.log for pod exec and secret access and list who did it."
"Check this audit log for RBAC changes to clusterrolebindings and any requests from system:anonymous."
"Turn the privileged pod creation pattern in this audit log into SIEM detection rules."
"Help me reconstruct what the user X did through the API server from this log."

Understand the example code

The skill's instructions include a short Python example that opens the log line by line, parses each event as JSON, and prints pod exec events with the user who ran them. A second example prints secret access along with the secret name. The bundled scripts/agent.py helper parses the log and flags these events.

with open("/var/log/kubernetes/audit.log") as f:
    for line in f:
        event = json.loads(line)
        verb = event.get("verb")
        resource = event.get("objectRef", {}).get("resource")
        user = event.get("user", {}).get("username")
        if verb == "create" and resource == "pods/exec":
            print(f"Pod exec by {user}")

Know what the skill does not cover

This skill works on the API server audit log only. It does not detect syscall-level activity inside running containers. For that, the skill itself points to detecting-container-runtime-threats-with-falco, which uses different tools and different data.

Do not use it for live production forensics without authorization. Audit data is sensitive, and the skill requires authorization for testing activities.

Tips for better results

Give the agent the exact path to the log and say whether it is a test copy. Ask for output that names the user, verb, resource and object name, since those fields drive every detection in the skill. If you plan to write SIEM rules, ask for the pattern first and then the rule, so you can check the logic against known events.

Name the log path and say whether it is a copy or production data
Ask for user, verb, objectRef and timestamp in the output
Review scripts/agent.py before running it on sensitive data
Cross-check flagged events against your audit policy levels in references/api-reference.md

What people use it for

Investigating whether an attacker opened a shell in a container or read secrets through the API server
Auditing which users or service accounts accessed pods, secrets or RBAC objects in a cluster
Writing Kubernetes-specific SIEM detection rules from known event patterns
Checking whether anonymous or system:unauthenticated requests reached the API server

Frequently asked questions

How do I install the Kubernetes audit log analysis skill?

Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

What do I need to run it?

You need Python 3.8 or newer, a Kubernetes API server audit log in JSON lines format, and access to the logs with authorization to analyze them. The skill's examples read /var/log/kubernetes/audit.log.

Is the skill free?

The skill is published under the Apache-2.0 licence. This page does not state pricing, so check the source repository for any terms beyond the licence.

Does it need internet access?

No. The skill is listed as not using the network. It does run Python scripts, so review scripts/agent.py before running it on sensitive data.

Can it detect activity inside running containers?

Not from the audit log. For syscall-level detection inside running containers, the skill points to detecting-container-runtime-threats-with-falco, which is a different tool that uses different data.

What are the alternatives?

The source does not compare this skill with other tools. For syscall-level container detection, the skill itself recommends detecting-container-runtime-threats-with-falco.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits security analysts investigating a suspected Kubernetes compromise, platform teams auditing pod, secret and RBAC access, and detection engineers writing cluster-specific SIEM rules. It is not the right choice for syscall-level detection inside containers or for live forensics on production data without authorization.

Download the skill