Kubernetes Audit Log Analysis
Investigates Kubernetes API audit logs for exec, secret, RBAC and anonymous-access threats
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
When installed, the agent can read Kubernetes API server audit logs (a record of who asked the cluster to do what) and look for signs of compromise, such as someone opening a shell inside a container, reading secrets, changing role permissions, creating privileged pods, or using anonymous access. It can also turn those patterns into SIEM detection rules and help reconstruct what an attacker did through the API. It includes a Python helper script that parses the log file and flags these events.
Great for
- Security analysts investigating a suspected Kubernetes cluster compromise
- Platform or SRE teams auditing who accessed pods, secrets or RBAC in a cluster
- Detection engineers writing Kubernetes-specific SIEM rules
Skip it if
- Detecting syscall-level activity inside running containers, which the skill itself says to use detecting-container-runtime-threats-with-falco for (different tool, different data)
- Live production forensics without authorization, since it reads sensitive audit data and the skill requires authorization for testing activities
Try asking
- “Analyze this kube-apiserver audit.log and list every pods/exec and attach event with user, namespace and source IP”
- “Find any secret get or list calls in the last audit log and show which users accessed which secret names”
- “Check the audit log for new clusterrolebinding creations and anonymous or system:unauthenticated requests”
- “Draft SIEM detection rules based on the Kubernetes audit event patterns found in this log”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-kubernetes-audit-logs.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-kubernetes-audit-logs.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-kubernetes-audit-logs.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Point the agent at a copy of the audit log rather than a live production file, and state the investigation scope and authorization up front
- Confirm your cluster's audit policy actually records the events you care about (for example pods/exec and secrets), since the skill cannot detect what was never logged
- Ask the agent to explain each finding's timestamp, user and source IP so results can be checked against other logs before acting
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.