# How to correlate Kubernetes audit logs with container runtime data

DevFeed: [How to correlate Kubernetes audit logs with container runtime data](<https://devfeed.tech/articles/how-to-correlate-kubernetes-audit-logs-with-container-runtime-data-49069.md>)

Original publisher: [Read original article](<https://www.elastic.co/security-labs/threat-command/kubernetes-audit-logs-container-escape>)

Author: Isai Anthony

Published: 2026-09-03T15:19:21Z

Content type: tutorial

Language: en

Sources: [Elastic Security Labs](<https://devfeed.tech/sources/elastic-security-labs.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [container escape](<https://devfeed.tech/topics/container-escape.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [audit](<https://devfeed.tech/topics/audit.md>), [data](<https://devfeed.tech/topics/data.md>), [SIEM, Security, Observability](<https://devfeed.tech/topics/siem-security-observability.md>), [Amazon EKS](<https://devfeed.tech/topics/amazon-eks.md>)

Tags: [amazon-elastic-kubernetes-service](<https://devfeed.tech/tags/amazon-elastic-kubernetes-service.md>), [api](<https://devfeed.tech/tags/api.md>), [audit](<https://devfeed.tech/tags/audit.md>), [container](<https://devfeed.tech/tags/container.md>), [container-escape](<https://devfeed.tech/tags/container-escape.md>), [control-plane](<https://devfeed.tech/tags/control-plane.md>), [detection-engineering](<https://devfeed.tech/tags/detection-engineering.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [kubernetes-audit-logs](<https://devfeed.tech/tags/kubernetes-audit-logs.md>), [logs](<https://devfeed.tech/tags/logs.md>), [pod](<https://devfeed.tech/tags/pod.md>), [process](<https://devfeed.tech/tags/process.md>)

## AI overview

This practical Elastic security post explains how to correlate Kubernetes audit logs with container runtime data. It identifies shared fields, join strategies, context fields, and queries for investigating activity such as secret access, privileged pod creation, and attempted container escape.

## Source excerpt

Two fields join the Kubernetes API to what ran inside the pod, and one turns up a container escape your process events never recorded.