analyzing-kubernetes-audit-logs

Name: analyzing-kubernetes-audit-logs
Author: mukul975

Skill by mukul975 · updated 1 month ago · ★ 35k

Score 84

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use when investigating a suspected cluster compromise, reconstructing what an attacker did through the API server, or writing Kubernetes-specific detection content. Keywords: audit policy, audit log, kube-apiserver, exec into pod, RBAC change, anonymous access, detection rules. Do not use for syscall-level detection inside a running container - use detecting-container-runtime-threats-with-falco. ' analyzing-kubernetes-audit-logs is published by mukul975 on GitHub.

Install GitHub

Yours? Claim it

Works withClaude CodeClaude apps Antigravity CLI

Maintenance

Last commit 53 days ago

Licence

Apache-2.0: permissive, fine for commercial use

Quality

Clear description, installs from GitHub, 34,884 stars, original repository

Security

Not checked yet. What we check

Install analyzing-kubernetes-audit-logs

Built from the published package, never by AI

git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/Anthropic-Cybersecurity-Skills && mkdir -p ~/.claude/skills && cp -r /tmp/Anthropic-Cybersecurity-Skills/skills/analyzing-kubernetes-audit-logs ~/.claude/skills/analyzing-kubernetes-audit-logs

Run in your terminal. Claude Code loads skills from ~/.claude/skills automatically.

Step-by-step: install analyzing-kubernetes-audit-logs in Claude Code

git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/Anthropic-Cybersecurity-Skills && mkdir -p ~/.gemini/antigravity-cli/skills && cp -r /tmp/Anthropic-Cybersecurity-Skills/skills/analyzing-kubernetes-audit-logs ~/.gemini/antigravity-cli/skills/analyzing-kubernetes-audit-logs

Antigravity CLI loads skills from ~/.gemini/antigravity-cli/skills, or .agents/skills for one project.

Step-by-step: install analyzing-kubernetes-audit-logs in Antigravity CLI

Skills can run scripts on your machine. Some need an API key: check the README.

Weekly newsletter

Like analyzing-kubernetes-audit-logs? Get the best new skills every week

The best new tools, security warnings before you install something risky, and one practical tip. Free, three minute read.

Alternatives to analyzing-kubernetes-audit-logs

All alternatives →

security-reviewcodewhale-hq

Review a change, module, or surface for exploitable defects — trust boundaries, authn/authz, injection, secret exposure, filesystem and network reach, dependency risk. Use when the user asks for a security review, audit, or vulnerability check of concrete code. Not for general code review, lint, or compliance paperwork.

AAA Skill 41k

slack-bot-buildersickn33

Build Slack apps using the Bolt framework across Python, JavaScript, and Java. Covers Block Kit for rich UIs, interactive components, slash commands, event handling, OAuth installation flows, and Workflow Builder integration.

AAA Skill 48k

review-codeverdaccio

Review a verdaccio diff, branch, or pull request against the repository review guide (security first, then npm-client compatibility, performance, product fit, maintainability), verify each finding against the code, and report actionable issues. Use for code reviews and for reviewing your own changes before or during a PR workflow.

AAA Skill 18k

game-server-securitygmh5225

Review multiplayer authority, RPCs, sessions, authorization, replication, inventory, economy, purchases, retries, and replay. Use when server or backend state is the security boundary.

AAA Skill 3.6k

redteam-cve-lookupNetw0rkNoob

CVE lookup and applicability assessment domain card. Use after reconnaissance has identified products, versions, services, or fingerprints and red-team mode needs evidence-based CVE matching before deeper testing.

AAA Skill 3.8k

reviewing-msbuild-codedotnet

Reviews MSBuild code changes using a 24-dimension methodology. Activates for code review, PR review, pull request analysis, design review, architecture review, code quality assessment, or style check of MSBuild code. Covers backwards compatibility, ChangeWave discipline, performance, allocation awareness, test coverage, error message quality, logging, string comparison, API surface, target authoring, cross-platform correctness, code simplification, concurrency, naming, SDK integration, evaluation model integrity, correctness, dependency management, security, and build infrastructure.

AAA Skill 5.5k

analyzing-kubernetes-audit-logs vs security-review analyzing-kubernetes-audit-logs vs slack-bot-builder analyzing-kubernetes-audit-logs vs review-code

analyzing-kubernetes-audit-logs: common questions

How do I install analyzing-kubernetes-audit-logs?

Run the command above to copy the skill into ~/.claude/skills/. Claude Code picks it up automatically.

Is analyzing-kubernetes-audit-logs free?

The code is published under the Apache-2.0 licence. The service it connects to may have its own pricing.

Is analyzing-kubernetes-audit-logs safe to use?

It scores 84 of 100. Grades: maintenance B, licence A, quality A. The security check has not run for it yet. Review the code before you install. How grades work.

What are alternatives to analyzing-kubernetes-audit-logs?