Completed upto lesson 28

lab/lesson-12-audit-ans.jsonl

@@ -0,0 +1,40 @@
+{"kind":"Event","apiVersion":"audit.k8s.io/v1",
+"level":"RequestResponse",
+"auditID":"a4",
+"stage":"ResponseComplete",
+"requestReceivedTimestamp":"2026-08-04T03:16:22Z",
+"verb":"create",
+"user":{"username":"system:serviceaccount:payments:api",
+"groups":["system:serviceaccounts"]},
+"sourceIPs":["10.244.3.77"],
+"objectRef":{"apiGroup":"rbac.authorization.k8s.io",
+"resource":"clusterrolebindings","name":"payments-api-admin"},
+"responseStatus":{"code":201}}
+
+{"kind":"Event",
+"apiVersion":"audit.k8s.io/v1",
+"level":"RequestResponse",
+"auditID":"a5",
+"stage":"ResponseComplete",
+"requestReceivedTimestamp":"2026-08-04T03:16:40Z",
+"verb":"get","user":{"username":"system:serviceaccount:payments:api",
+"groups":["system:serviceaccounts"]},
+"sourceIPs":["10.244.3.77"],
+"objectRef":{"resource":"secrets",
+"namespace":"payments",
+"name":"prod-db"},"responseStatus":{"code":200}}
+
+Which principal is suspicious?
+a4 and a5 a6
+What source IP is associated with the activity?
+10.244.3.77
+What is the earliest suspicious timestamp?
+"2026-08-04T03:16:22Z"
+Which ClusterRoleBinding was created?
+payments-api-admin
+Which Secret was accessed?
+"prod-db"
+What runtime action followed the Secret access?
+exec
+Give two immediate containment actions, in order.
+get secret, exec in pod