How to correlate Kubernetes audit logs with container runtime data
MentionsKubernetes
If you already ship Kubernetes (K8s) audit logs and Defend for Containers (D4C) into Elastic, you still have to join them by hand, and neither source is complete on its own. In our lab, a compromised workload service account ran discovery, read secrets, minted a token, created a privileged pod, and execed into it to attempt a container escape.
Summary from Elastic Security Labs.
Explained
The technology and terms in this story. Learn more