Audit log in production — the security investigation and compliance

The audit log in production is the security trail and the compliance audit input. The security investigation, the compliance audit, the SIEM integration are the components. This lesson walks the audit log in production, the security investigation, the compliance patterns, and the SIEM integration.

The audit log in production

The audit log in production:

flowchart LR
    A[Audit event] --> B[kube-apiserver]
    B --> C[Log file]
    B --> D[Webhook]
    C --> E[Log shipping]
    D --> F[SIEM]
    E --> G[Long-term storage]
    F --> G
    G --> H[Security investigation]
    H --> I[Compliance audit]

The audit log is the security trail.

The security investigation

The security investigation:

# Find all requests by a specific user
grep '"username":"compromised-user"' /var/log/kubernetes/audit.log

# Find all secret operations
grep '"resource":"secrets"' /var/log/kubernetes/audit.log

# Find all privileged operations
grep '"resource":"pods/exec"' /var/log/kubernetes/audit.log

# Find all RBAC changes
grep '"resource":"rolebindings"' /var/log/kubernetes/audit.log

The security investigation is the input for the incident response.

The compliance audit

The compliance audit:

# Generate the audit log report
kubelogin aws s3 cp s3://k8s-audit-logs/audit.log /tmp/audit.log

# Verify the audit policy is configured
kubectl get --raw=/api/v1/namespaces

# Verify the audit log is being written
ls /var/log/kubernetes/audit.log*

# Verify the audit log is being shipped
aws s3 ls s3://k8s-audit-logs/

The compliance audit is the input for the regulation.

The SOC 2 audit

The SOC 2 audit:

# SOC 2 audit requirements
- Audit log of all API server requests
- Audit log of all secret operations
- Audit log of all RBAC changes
- Audit log of all privileged operations
- Audit log retention for 1+ year
- Audit log shipped to long-term storage
- Audit log integrity verified

The SOC 2 audit is the security compliance.

The GDPR audit

The GDPR audit:

# GDPR audit requirements
- Audit log of all data access
- Audit log of all data modifications
- Audit log of all data deletions
- Audit log retention for the specified period
- Audit log access control
- Audit log integrity verified

The GDPR audit is the data protection.

The PCI-DSS audit

The PCI-DSS audit:

# PCI-DSS audit requirements
- Audit log of all cardholder data access
- Audit log of all privileged operations
- Audit log of all authentication events
- Audit log retention for 1+ year
- Audit log integrity verified (WORM storage)
- Audit log access control

The PCI-DSS audit is the cardholder data protection.

The SIEM integration

The SIEM integration:

# Splunk integration
splunk:
  url: https://splunk.example.com:8088
  token: <token>
  index: kubernetes-audit

# Elasticsearch integration
elasticsearch:
  url: https://elasticsearch.example.com:9200
  username: <username>
  password: <password>
  index: kubernetes-audit

# Sumo Logic integration
sumologic:
  url: https://sumologic.example.com
  access_key: <key>
  access_id: <id>

The SIEM integration is the central log.

The audit log analysis

The audit log analysis:

# Splunk query: failed authentication
index=kubernetes-audit "responseStatus.code"=401 | stats count by user.username

# Elasticsearch query: secret access
audit_request_object_resource:"secrets" | stats count by user.username

# Sumo Logic query: privileged operations
_sourceCategory=kubernetes-audit operation:pods/exec | count by user.username

The audit log analysis is the security intelligence.

The production patterns

The production patterns:

flowchart LR
    A[Audit event] --> B[kube-apiserver]
    B --> C[Log file]
    C --> D[Log shipping]
    D --> E[SIEM]
    E --> F[Security investigation]
    F --> G[Compliance audit]
    G --> H[Long-term storage]

The pattern is the production discipline.

The cross-course references

• The API server course covers the audit configuration.
• The Security course covers the audit policies.
• The SIEM course covers the integration.

Quiz

Production discipline

• Use the audit log for security investigation. The incident response.
• Use the audit log for compliance audit. The SOC 2, GDPR, PCI-DSS.
• Integrate with the SIEM. The central log.
• Configure the retention. 1 year S3, 5 years Glacier.
• Document the audit log production. The compliance.
• Test the audit log. The verification.

The audit log in production is the security trail and the compliance audit input. Operating it well is the security investigation, the compliance patterns, and the SIEM integration.