As cited
Copy frozen at (site build).
cloud saas
How to correlate Kubernetes audit logs with container runtime data
Correlating Kubernetes audit logs with container runtime data from Defend for Containers requires joining two distinct data sources that answer different questions: audit logs capture control-plane activity and which objects changed, while runtime data shows what executed inside containers. The article provides field mappings and two join strategies depending on whether the application programming interface (API) call includes pod-name attribution, and demonstrates the techniques with a lab scenario involving a compromised service account that created a privileged pod and attempted container escape.
Why it matters: Security practitioners using Elastic must understand how to connect Kubernetes audit logs and container runtime telemetry to detect multi-plane attacks; the techniques and prebuilt rules shown enable investigation of control-plane abuse alongside runtime process activity to build complete attack timelines.
- Source published
- First seen by Cybersecurity Tracker