sudo cscli collections install crowdsecurity/k8s-auditThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Hover a line or a note to see what each field does.
name: crowdsecurity/k8s-auditparsers:- crowdsecurity/k8s-auditscenarios:- crowdsecurity/k8s-audit-anonymous-access- crowdsecurity/k8s-audit-api-server-bruteforce- crowdsecurity/k8s-audit-pod-host-network- crowdsecurity/k8s-audit-pod-exec- crowdsecurity/k8s-audit-pod-host-path-volume- crowdsecurity/k8s-audit-privileged-pod-creation- crowdsecurity/k8s-audit-service-account-access-denieddescription: "Kubernetes audit log support: detect security sensitive events in a cluster"labels:label: "Kubernetes - Audit Detection"author: crowdsecuritytags:- security_engine- kubernetes- notification- audit
Sign in to see the Security Engines that run this collection, the version they run and whether it was modified locally.
⚠️ This version requires crowdsec version 1.5 ⚠️
A collection for Kubernetes audit logs :
Most scenarios in this collection will not lead to a decision, they are mostly intended for notification purposes.
As this collection is mostly intended for notifications, you will need to update your /etc/crowdsec/profiles.yaml to add support for alerts without remediation.
For example, if you want slack notifications, add the following at the top of the file:
1name: k8s_audit_notification2filters:3 - Alert.Remediation == false && Alert.GetScenario() startsWith "crowdsecurity/k8s-audit"4notifications:5 - slack_k8s_audit6on_success: break7---
Next, edit /etc/crowdsec/notifications/slack.yaml as follow:
1type: slack2name: slack_k8s_audit34log_level: info56format: |7 Kubernetes Security Alert:8 {{range . -}}9 {{$alert := . -}}10 {{- $resource_name := GetMeta $alert "resource_name" -}}11 {{- $resource_kind := GetMeta $alert "kind" -}}12 - Scenario: {{$alert.Scenario}}13 - Source IP: {{GetMeta $alert "source_ip"}}14 - User: {{GetMeta $alert "user"}}15 - Namespace: {{GetMeta $alert "namespace"}}16 {{- if $resource_name }}17 - Resource Name: {{GetMeta $alert "resource_name"}}18 {{- end -}}19 {{- if $resource_name }}20 - Resource Kind: {{GetMeta $alert "kind"}}21 {{- end }}22 ----23 {{end -}}242526webhook: <WEBHOOK_URL>
More informations about the notification system can be found in our documentation
Example acquisition for this collection if you log to a file:
1filenames:2 - /var/log/k8s/audit.log3labels:4 type: k8s-audit
Example acquisition for this collection if you use the k8s_audit datasource:
1source: k8s_audit2listen_addr: 0.0.0.03listen_port: 42424webhook_path: /audit/webhook/event5labels:6 type: k8s-audit