Cloud

Kubernetes Audit Logs

Kubernetes API server audit log events — CRUD operations on cluster resources, health probes, RBAC access checks, watch streams, pod exec/attach, and API discovery across a multi-namespace production cluster.

View on GitHub

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/kubernetes-audit/generator.yml \
  --id kubernetes-audit \
  --live-mode true

Event Types

Event ID	Description	Frequency	Category
health-probe	Health/readiness/liveness probe checks	~25%	web
get-resource	GET single resource (pods, services, configmaps, secrets)	~17%	web
list-resource	LIST resources across namespaces	~13%	web
watch-resource	Long-running WATCH streams from controllers/operators	~15%	web
api-discovery	API discovery endpoints (/api, /apis, /openapi)	~10%	web
create-resource	CREATE new resources (pods, deployments, services)	~5%	web
update-resource	UPDATE/PATCH existing resources and status subresources	~5%	web
delete-resource	DELETE resources	~2%	web
rbac-access	RBAC operations (clusterroles, roles, bindings)	~5%	iam
exec-attach	Pod exec, attach, port-forward, and log access	~3%	process

Realism Features

Jinja2 base template macro eliminates boilerplate across 10 templates
Multi-namespace cluster — 8 namespaces with weighted selection
Error injection (~3%) — 403, 404, 409, 422 status codes
Realistic user agents — kubectl, kube-probe, controller-manager, operator SDKs
5 identity types — human users, service accounts, system components
Full audit metadata — auditID, request/stage timestamps, annotations

Sample Output

{
    "@timestamp": "2026-03-06T14:30:45.123456+00:00",
    "agent": {
        "ephemeral_id": "d27511c8-9cd1-402c-8b1b-234abbd9dcae",
        "id": "6e730a0c-7da5-48ff-b4c9-f6c63844975d",
        "name": "kind-control-plane",
        "type": "filebeat",
        "version": "8.17.0"
    },
    "ecs": {"version": "8.17.0"},
    "data_stream": {
        "dataset": "kubernetes.audit_logs",
        "namespace": "default",
        "type": "logs"
    },
    "event": {
        "action": "get",
        "category": ["web"],
        "dataset": "kubernetes.audit_logs",
        "kind": "event",
        "module": "kubernetes",
        "outcome": "success",
        "type": ["access"]
    },
    "kubernetes": {
        "audit": {
            "auditID": "bcacfeaa-5ab5-48de-8bac-3a87d1474b6a",
            "apiVersion": "audit.k8s.io/v1",
            "kind": "Event",
            "level": "RequestResponse",
            "stage": "ResponseComplete",
            "verb": "get",
            "requestURI": "/api/v1/namespaces/production/pods/api-server-7b8c9d-x4k2m",
            "user": {
                "username": "alice.chen@acme.io",
                "groups": ["system:authenticated", "developers"]
            },
            "sourceIPs": ["10.0.15.42"],
            "userAgent": "kubectl/v1.29.2 (linux/amd64)",
            "responseStatus": {"metadata": {}, "code": 200},
            "requestReceivedTimestamp": "2026-03-06T14:30:45.123456Z",
            "stageTimestamp": "2026-03-06T14:30:45.124567Z"
        }
    },
    "orchestrator": {
        "cluster": {"name": "production-cluster"},
        "type": "kubernetes"
    },
    "related": {"ip": ["10.0.15.42"], "user": ["alice.chen@acme.io"]},
    "source": {"ip": "10.0.15.42"},
    "tags": ["forwarded", "kubernetes-audit"],
    "user": {"name": "alice.chen@acme.io"},
    "user_agent": {"original": "kubectl/v1.29.2 (linux/amd64)"}
}

Parameters

Parameter	Default	Description
agent_id	6e730a0c-...	Filebeat agent UUID
agent_version	8.17.0	Elastic Agent version
agent_name	kind-control-plane	Agent hostname
cluster_name	production-cluster	Kubernetes cluster name
error_rate	3	Error injection rate (percentage, 0-100)

Related Generators

Cloud

AWS CloudTrail Management Events

AWS CloudTrail audit trail — API calls across EC2, IAM, STS, and S3 from a multi-account organization. Includes console logins, role assumptions, error injection, and 4 identity types.

Cloud

AWS GuardDuty Findings

AWS GuardDuty threat detection findings across EC2, IAM, and S3 resources. Covers 8 categories — Recon, UnauthorizedAccess, Policy, Trojan, Impact, CryptoCurrency, Stealth, and Backdoor — with 27 finding types, 10 threat actor IPs, and geo/ASN enrichment.

Cloud

AWS VPC Flow Logs

AWS VPC Flow Logs (v5) — network traffic records across multiple accounts, VPCs, and subnets. TCP/UDP/ICMP flows with ACCEPT/REJECT actions, NAT gateway traffic, and realistic byte/packet distributions.