From the course: Kubernetes Threat and Attack Detection by Pearson
Unlock this course with a free trial
Join today to access over 25,300 courses taught by industry experts.
Define an audit policy - Kubernetes Tutorial
From the course: Kubernetes Threat and Attack Detection by Pearson
Define an audit policy
Now, in the previous lesson, we have talked about how to configure the API server as well as some of the different characteristics you need to set in place in order to be able to turn logging on. But what does the logging file look like? Well, ultimately, it's going to be written in JSON. Now, there is an option to be able to set it to string values instead of JSON. That's something you can configure in hard code, but by default, it's going to choose JSON. And the example over on the right is what a logging message will potentially look like. So this is going to give you all the details. You can see things like IP addresses. You can see, you know, the various groups and the specific API calls that are being added as well as any of the activities and, you know, this is actually getting both. This is a response request as well as the response that it's being sent. So you're getting a full view of what that type of a message would be. So the user information again, and any type of…