name: Kubernetes Audit
id: 6c25181a-0c07-4aaf-90e6-77ab1f0e6699
version: 3
creation_date: '2024-07-16'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
description: Logs activities within a Kubernetes cluster, including API server requests, resource access, configuration changes, and user authentication events.
mitre_components:
    - Pod Metadata
    - Pod Modification
    - Cluster Metadata
    - User Account Authentication
    - Configuration Modification
    - Application Log Content
source: kubernetes
sourcetype: _json
supported_TA: []
fields:
    - _time
    - annotations.authorization.k8s.io/decision
    - annotations.authorization.k8s.io/reason
    - apiVersion
    - auditID
    - eventtype
    - host
    - index
    - kind
    - level
    - linecount
    - objectRef.apiGroup
    - objectRef.apiVersion
    - objectRef.namespace
    - objectRef.resource
    - punct
    - requestReceivedTimestamp
    - requestURI
    - responseObject.apiVersion
    - responseObject.code
    - responseObject.details.group
    - responseObject.details.kind
    - responseObject.kind
    - responseObject.message
    - responseObject.reason
    - responseObject.status
    - responseStatus.code
    - responseStatus.details.group
    - responseStatus.details.kind
    - responseStatus.message
    - responseStatus.reason
    - responseStatus.status
    - source
    - sourceIPs{}
    - sourcetype
    - splunk_server
    - stage
    - stageTimestamp
    - tag
    - tag::eventtype
    - timestamp
    - user.groups{}
    - user.uid
    - user.username
    - userAgent
    - verb
example_log: '{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"RequestResponse","auditID":"582c31ab-4906-49bb-9ff9-872f980ccb84","stage":"ResponseComplete","requestURI":"/apis/batch/v1/namespaces/test2/jobs?fieldManager=kubectl-create\u0026fieldValidation=Strict","verb":"create","user":{"username":"k8s-test-user","uid":"aws-iam-authenticator:111111111111:AROAYTXXXXXXHNXXXXX","groups":["system:authenticated"]},"sourceIPs":["176.95.188.101"],"userAgent":"kubectl/v1.27.2 (darwin/arm64) kubernetes/7f6f68f","objectRef":{"resource":"jobs","namespace":"test2","apiGroup":"batch","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"jobs.batch is forbidden: User \"k8s-test-user\" cannot create resource \"jobs\" in API group \"batch\" in the namespace \"test2\"","reason":"Forbidden","details":{"group":"batch","kind":"jobs"},"code":403},"responseObject":{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"jobs.batch is forbidden: User \"k8s-test-user\" cannot create resource \"jobs\" in API group \"batch\" in the namespace \"test2\"","reason":"Forbidden","details":{"group":"batch","kind":"jobs"},"code":403},"requestReceivedTimestamp":"2023-12-07T14:44:53.358394Z","stageTimestamp":"2023-12-07T14:44:53.375985Z","annotations":{"authorization.k8s.io/decision":"forbid","authorization.k8s.io/reason":""}}'