# Threat Hunting with Kubernetes Audit Logs

DevFeed: [Threat Hunting with Kubernetes Audit Logs](<https://devfeed.tech/articles/threat-hunting-with-kubernetes-audit-logs-15922.md>)

Original publisher: [Read original article](<https://developer.squareup.com/blog/threat-hunting-with-kubernetes-audit-logs>)

Author: Ramesh Ramani

Published: 2021-08-03T19:00:00Z

Content type: tutorial

Language: en

Sources: [Square Corner Blog RSS Feed](<https://devfeed.tech/sources/square-corner-blog-rss-feed.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Threat Hunting & Intel](<https://devfeed.tech/topics/threat-hunting-intel.md>), [SIEM, Security, Observability](<https://devfeed.tech/topics/siem-security-observability.md>), [Amazon EC2](<https://devfeed.tech/topics/amazon-ec2.md>), [Amazon Elastic Kubernetes Service](<https://devfeed.tech/topics/amazon-elastic-kubernetes-service.md>), [Operator Lifecycle Manager](<https://devfeed.tech/topics/olm.md>)

Tags: [api-server](<https://devfeed.tech/tags/api-server.md>), [audit](<https://devfeed.tech/tags/audit.md>), [audit-trail](<https://devfeed.tech/tags/audit-trail.md>), [aws](<https://devfeed.tech/tags/aws.md>), [clusters](<https://devfeed.tech/tags/clusters.md>), [ec2](<https://devfeed.tech/tags/ec2.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [kubernetes-clusters](<https://devfeed.tech/tags/kubernetes-clusters.md>), [logs](<https://devfeed.tech/tags/logs.md>)

## AI overview

This tutorial introduces Kubernetes audit logs and explains how they can provide an audit trail of API calls for threat hunting. It outlines a process for understanding the environment, forming and testing hypotheses, identifying anomalous behavior, establishing repeatable patterns, and enriching detection pipelines.

## Source excerpt

Analyzing Kubernetes audit logs to look for potential threats