completed lesson 31

lessons/0032-audit-success-vs-attempt.html

@@ -0,0 +1,58 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <title>Lesson 32: Audit success versus attempt</title>
+  <link rel="stylesheet" href="../assets/course.css">
+</head>
+<body>
+<main>
+  <p class="eyebrow">Lesson 0032 · 20 minutes · Monitoring, Logging, and Runtime Security</p>
+  <h1>Separate a failed attack from a successful compromise</h1>
+  <p class="lede">Suspicious intent is not the same as successful impact. Reconstruct the incident from the authenticated principal, affected resources, timestamps, and HTTP response codes.</p>
+
+  <h2>Timed task: 12 minutes</h2>
+  <p>Analyze <code>lab/lesson-32-audit.jsonl</code> with a structured JSON tool. Create <code>lab/lesson-32-answer.md</code> containing concise answers to these questions:</p>
+  <ol>
+    <li>Which suspicious RBAC request failed, who made it, and what evidence proves it failed?</li>
+    <li>Which principal completed the successful attack sequence?</li>
+    <li>What was the first successful escalation event? Include timestamp, verb, resource type, namespace, and resource name.</li>
+    <li>Which credential-bearing object was accessed successfully?</li>
+    <li>What runtime action followed?</li>
+    <li>Give three immediate containment actions in operational order.</li>
+  </ol>
+  <p>Also include the exact command you used. Do not identify a principal by audit ID, and do not describe a rejected request as a completed privilege escalation.</p>
+
+  <div class="callout"><strong>Incident reflex:</strong> read <code>responseStatus.code</code> before claiming impact. Then pivot on <code>user.username</code>, source IP, and time. Contain the authority first, isolate execution second, and rotate exposed credentials after access is stopped.</div>
+
+  <h2>PowerShell starting point</h2>
+  <pre><code>Get-Content .\lab\lesson-32-audit.jsonl |
+  ForEach-Object { $_ | ConvertFrom-Json } |
+  Select-Object requestReceivedTimestamp, verb,
+    @{n='principal';e={$_.user.username}},
+    @{n='code';e={$_.responseStatus.code}}, objectRef</code></pre>
+
+  <h2>Retrieval check</h2>
+  <div class="quiz">
+    <h3>Question</h3>
+    <p>An audit event shows a suspicious RBAC create request with response code 403. What can you conclude?</p>
+    <label><input type="radio" name="q" value="attempt">The request was attempted but this event does not prove the binding was created.</label>
+    <label><input type="radio" name="q" value="success">The binding was created and the principal gained the requested permissions.</label>
+    <label><input type="radio" name="q" value="unknown">The event contains no useful evidence about whether the request succeeded.</label>
+    <button onclick="check()">Check answer</button>
+    <p id="feedback" class="feedback" aria-live="polite"></p>
+  </div>
+
+  <h2>Documentation target</h2>
+  <p>Use the official Kubernetes <a href="https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/">auditing documentation</a> after your first attempt.</p>
+
+  <h2>What to send me</h2>
+  <p>Save the incident note, then say <em>check</em>. I will list all detected issues and help you correct only one per round. Ask me a follow-up question if any audit field is unclear.</p>
+  <footer>Previous: <a href="0031-cel-privileged-container-policy.html">CEL privileged-container policy</a> · CKS path: Monitoring, Logging, and Runtime Security</footer>
+</main>
+<script>
+function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='attempt'){f.textContent='Correct. HTTP 403 records a rejected attempt, not a successful RBAC change.';f.className='feedback good';}else{f.textContent='Not quite. Response code 403 means the API server rejected this request.';f.className='feedback bad';}}
+</script>
+</body>
+</html>