Lesson 0012 · 30 minutes · Monitoring, Logging, and Runtime Security

Reconstruct an RBAC escalation from audit evidence

Audit logs record API activity, not intent. Your job is to filter noise, correlate a principal and source address, and identify the attack sequence with evidence.

Incident reflex: begin with high-impact API resources and verbs—RBAC writes, Secret reads, and exec activity—then pivot by username, source IP, and timestamps.

Timed task: 20 minutes

Analyze lab/lesson-12-audit.jsonl. Do not edit the file. Send me a concise incident note answering all of these:

  1. Which principal is suspicious?
  2. What source IP is associated with the activity?
  3. What is the earliest suspicious timestamp?
  4. Which ClusterRoleBinding was created?
  5. Which Secret was accessed?
  6. What runtime action followed the Secret access?
  7. Give two immediate containment actions, in order.

Use PowerShell, jq, or another structured JSON tool. Do not rely on free-text visual scanning alone.

Useful investigation shapes

Get-Content .\lab\lesson-12-audit.jsonl | ForEach-Object { $_ | ConvertFrom-Json } | Where-Object { $_.objectRef.resource -in 'clusterrolebindings','secrets' } | Select-Object requestReceivedTimestamp, verb, user, sourceIPs, objectRef

# Linux exam-style equivalent
jq -c 'select(.objectRef.resource == "clusterrolebindings" or .objectRef.resource == "secrets")' lesson-12-audit.jsonl

Retrieval check

Question

Which audit event is the strongest initial indicator of privilege escalation?

Documentation target

Use the official Kubernetes auditing documentation to review audit stages, levels, and policy behavior.

What to send me

Send your seven answers and the exact filter command you used. I’ll check the timeline and the containment priorities.