From the course: Certified Kubernetes Security Specialist (CKS) Cert Prep

Unlock this course with a free trial

Join today to access over 25,300 courses taught by industry experts.

Security event log review

Security event log review - Kubernetes Tutorial

From the course: Certified Kubernetes Security Specialist (CKS) Cert Prep

Start my 1-month free trial Buy for my team

Security event log review

“

- Reviewing Kubernetes logs is one of the first things that you're going to need to do because ultimately, logs are the first line of defense in identifying any suspicious behavior that could be happening within your cluster. And part of the CKS exam is intended to be able to test your ability to be able to interpret and act on these various logs. Now, there are a number of essential logs that we've talked about throughout the course and focusing on things like the API server's audit logs, those are going to be really, really important, as well as the kubelet logs, the pod logs, and the event logs that you're typically going to see. Now, various applications that we've talked about, like Falco, they're going to have their own logs, so being able to know where to find potential issues is part of the exam as well. Now, these different ones, you can use various tools to be able to get access to them, but as you start to look at being able to parse through them and to see the different…

Contents