"A Monitoring Platform for Kubernetes...
summary
A centralised monitoring pipeline collects Kubernetes audit logs (audit policy on kube-apiserver → Fluentd daemonset → Elasticsearch → Kibana) and feeds a Python analyser that labels events, producing the K8SD security dashboard. Detections include exact API calls: secret listing, kubectl exec, creation of privileged pods with hostPath, and daemonset-based mass compromise; demos create a privileged nginx pod, mount the host filesystem and obtain root. All code and deployment YAMLs are released open-source.
AI-written summary · about
chapters (5)
- 0:00Start
- 14:20logging architecture
- 18:11attack traces
- 23:06alert system
- 28:57kubernetes security dashboard
related talks
30mA Monitoring Platform for Kubernetes Cluster Security
29mDetection Engineering in Kubernetes Environments: Wrangling Security Data Out of You...
20mUncovering a Sophisticated Kubernetes Attack in Real-Time
30mEffective Detection in Kubernetes Clusters
35mUsing K8s Audit Logs to Secure Your Cluster
37mProactive Kubernetes Security: Anomaly Detection and Runtime Alertin...
12mKeynote: K8s Security Safari: Hunting Threats in the Wild Wild Cloud
43mKubernetes Security: Attacking and Defending Modern Infrastructure