Results for “experiment-logs”

Detect intrusion attempts, unauthorized access, and privilege escalation on Linux hosts using the auditd framework with ausearch and aureport utilities.

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns.