# MKS

Published articles for MKS.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Blog: Detecting Threats in OVHcloud MKS Audit Logs with Falco

DevFeed: [Blog: Detecting Threats in OVHcloud MKS Audit Logs with Falco](<https://devfeed.tech/articles/blog-detecting-threats-in-ovhcloud-mks-audit-logs-with-falco-32478.md>)

Original publisher: [Read original article](<https://falco.org/blog/detect-threats-falco-ovh-mks-audit-logs-plugin/>)

Published: 2025-03-13T00:00:00Z

Content type: tutorial

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Security](<https://devfeed.tech/topics/security.md>), [threat detection](<https://devfeed.tech/topics/threat-detection.md>), [Kubernetes clusters](<https://devfeed.tech/topics/kubernetes-clusters.md>), [kubectl](<https://devfeed.tech/topics/kubectl.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [api server](<https://devfeed.tech/topics/api-server.md>), [container](<https://devfeed.tech/topics/container.md>), [Amazon EKS](<https://devfeed.tech/topics/amazon-eks.md>), [Amazon Elastic Kubernetes Service](<https://devfeed.tech/topics/amazon-elastic-kubernetes-service.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [audit](<https://devfeed.tech/tags/audit.md>), [auditlogs](<https://devfeed.tech/tags/auditlogs.md>), [container](<https://devfeed.tech/tags/container.md>), [falco](<https://devfeed.tech/tags/falco.md>), [kubectl](<https://devfeed.tech/tags/kubectl.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [linux](<https://devfeed.tech/tags/linux.md>), [logs](<https://devfeed.tech/tags/logs.md>), [mks](<https://devfeed.tech/tags/mks.md>), [ovhcloud](<https://devfeed.tech/tags/ovhcloud.md>), [plugin](<https://devfeed.tech/tags/plugin.md>), [security](<https://devfeed.tech/tags/security.md>), [threat-detection](<https://devfeed.tech/tags/threat-detection.md>)

### AI overview

This article explains how Falco uses the OVHcloud MKS Audit Logs plugin to detect anomalies, suspicious activity, and policy violations in Kubernetes clusters. It describes Falco's event processing and outlines the required setup involving OVHcloud Logs Data Platform, a data stream, and an MKS cluster.

### Source excerpt

Detecting threats in a Kubernetes cluster can be challenging, we generally don't know where and how to start. The good news is that we have an amount of valuable logs that can help us to know what is happened in the cluster. Indeed, each action requested or done by a user or an app, in a cluster, is recorded in Audit Logs. Kubernetes events are key to understanding the behavior of a cluster. We already provide plugins that let you parse Audit Logs and use Falco to detect threats from GKE, EKS and AKS clusters. With our latest plugin, you'll now have the same powerful threat detection capabilities for your OVHcloud MKS clusters 🎉. What is Falco? Falco is an Open Source cloud-native runtime security tool. It provides near real-time threat detection for cloud, container, and Kubernetes workloads by leveraging runtime insights. Falco can monitor events from various sources, including the Linux kernel, and enrich them with metadata from the Kubernetes API server, container runtime, and more. Falco can receive Events, compare them to a set of Rules to determine the actions to perform and generate Alerts to different endpoints. What is the OVH MKS Audit Logs plugin? The OVH audit logs plugin (k8saudit-ovh) extends Falco's capabilities to OVHcloud Managed Kubernetes Service (MKS) clusters, providing you with the same security insights and threat detection Falco already offers for GKE, EKS and AKS environments. With this plugin, you can seamlessly integrate MKS Audit Logs into Falco's event processing pipeline, enabling it to identify anomalies, suspicious activities, and policy violations within your MKS-based workloads. Concretely, when a user executes some kubectl commands in an OVHcloud MKS cluster, Audit Logs will be generated. Falco is listening to them, and depending on the configured rules to follow, it will generate some alerts. Using OVH MKS Audit Logs plugin In order to use the OVH MKS Audit Logs plugin, you must follow several steps: deploy an OVHcloud LDP (Logs