5 lines
3.4 KiB
HTML
5 lines
3.4 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CKS lesson 12: Audit investigation</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0012 · 30 minutes · Monitoring, Logging, and Runtime Security</p><h1>Reconstruct an RBAC escalation from audit evidence</h1><p class="lede">Audit logs record API activity, not intent. Your job is to filter noise, correlate a principal and source address, and identify the attack sequence with evidence.</p><div class="callout"><strong>Incident reflex:</strong> begin with high-impact API resources and verbs—RBAC writes, Secret reads, and exec activity—then pivot by username, source IP, and timestamps.</div><h2>Timed task: 20 minutes</h2><p>Analyze <code>lab/lesson-12-audit.jsonl</code>. Do not edit the file. Send me a concise incident note answering all of these:</p><ol><li>Which principal is suspicious?</li><li>What source IP is associated with the activity?</li><li>What is the earliest suspicious timestamp?</li><li>Which ClusterRoleBinding was created?</li><li>Which Secret was accessed?</li><li>What runtime action followed the Secret access?</li><li>Give two immediate containment actions, in order.</li></ol><p>Use PowerShell, <code>jq</code>, or another structured JSON tool. Do not rely on free-text visual scanning alone.</p><h2>Useful investigation shapes</h2><pre><code>Get-Content .\lab\lesson-12-audit.jsonl | ForEach-Object { $_ | ConvertFrom-Json } | Where-Object { $_.objectRef.resource -in 'clusterrolebindings','secrets' } | Select-Object requestReceivedTimestamp, verb, user, sourceIPs, objectRef
|
||
|
||
# Linux exam-style equivalent
|
||
jq -c 'select(.objectRef.resource == "clusterrolebindings" or .objectRef.resource == "secrets")' lesson-12-audit.jsonl</code></pre><h2>Retrieval check</h2><div class="quiz"><h3>Question</h3><p>Which audit event is the strongest initial indicator of privilege escalation?</p><label><input type="radio" name="q" value="binding">Creating a ClusterRoleBinding.</label><label><input type="radio" name="q" value="service">Reading a Service.</label><label><input type="radio" name="q" value="pod">Creating an ordinary application Pod.</label><button onclick="check()">Check answer</button><p id="feedback" class="feedback" aria-live="polite"></p></div><h2>Documentation target</h2><p>Use the official Kubernetes <a href="https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/">auditing</a> documentation to review audit stages, levels, and policy behavior.</p><h2>What to send me</h2><p>Send your seven answers and the exact filter command you used. I’ll check the timeline and the containment priorities.</p><footer>Previous: <a href="0011-apparmor-runtime-confinement.html">AppArmor runtime confinement</a> · CKS domain: Monitoring, Logging, and Runtime Security</footer></main><script>function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='binding'){f.textContent='Correct. Creating a ClusterRoleBinding can grant broad authority and warrants immediate investigation.';f.className='feedback good';}else{f.textContent='Not quite. An RBAC binding write is a high-impact control-plane action and a strong escalation signal.';f.className='feedback bad';}}</script></body></html>
|