{"kind":"Event","apiVersion":"audit.k8s.io/v1",
"level":"RequestResponse",
"auditID":"a4",
"stage":"ResponseComplete",
"requestReceivedTimestamp":"2026-08-04T03:16:22Z",
"verb":"create",
"user":{"username":"system:serviceaccount:payments:api",
"groups":["system:serviceaccounts"]},
"sourceIPs":["10.244.3.77"],
"objectRef":{"apiGroup":"rbac.authorization.k8s.io",
"resource":"clusterrolebindings","name":"payments-api-admin"},
"responseStatus":{"code":201}}

{"kind":"Event",
"apiVersion":"audit.k8s.io/v1",
"level":"RequestResponse",
"auditID":"a5",
"stage":"ResponseComplete",
"requestReceivedTimestamp":"2026-08-04T03:16:40Z",
"verb":"get","user":{"username":"system:serviceaccount:payments:api",
"groups":["system:serviceaccounts"]},
"sourceIPs":["10.244.3.77"],
"objectRef":{"resource":"secrets",
"namespace":"payments",
"name":"prod-db"},"responseStatus":{"code":200}}

Which principal is suspicious?
a4 and a5 a6
What source IP is associated with the activity?
10.244.3.77
What is the earliest suspicious timestamp?
"2026-08-04T03:16:22Z"
Which ClusterRoleBinding was created?
payments-api-admin
Which Secret was accessed?
"prod-db"
What runtime action followed the Secret access?
exec
Give two immediate containment actions, in order.
get secret, exec in pod