Skip to content
Free lab · no signup · Kubernetes log triage

Kubernetes & Cloud-Native Log Triage

A synthetic shift of API server audit, admission, runtime, registry, CI/CD, cloud IAM, ingress and node events from fictional production clusters. Most of it is GitOps and autoscaling noise. Find the events that are not, name the field that gives them away, and map each to MITRE ATT&CK.

Tiers
Trainee · Analyst · Lead
Logs per shift
400–1000
Attack types
6
Mapped to
MITRE ATT&CK Enterprise

Your journey → certificate

BronzeSilverGold

Loading your progress…

All log triage tracks and the capstone · practice certificates, not accredited credentials.

1 in 5 logs hides an attack. 400 logs in the practice set.
10 logs ≈ 3 minutes → a graded shift scorecard you can share.

How to play: a 20-second start

  1. Pick a log in the inbox. Most are normal operations; a few are attacks.
  2. In the detail pane, click any field value that looks wrong.
  3. Hit Check: green = a real flag caught, amber = a flag missed, red = false alarm, each with a “why”.
  4. Stuck? Press Reveal to learn the answer (not scored). Use End shift for your report.
0Reviewedof 400
0Signals caught
0Missed
0False alarms
0%Recallof red flags
0Streak
0/10 logs to your shift scorecard
Inbox400 logs
Admission ControllerinfoL100264 · 23:57:41 UTC

Pod admitted: checkout-api

checkout/checkout-api

Click any field value you think is a red flag (or press 1–9), then Check.

0/10 logs to your shift scorecard

How scoring works

Your shift score (0–100) is 60% red-flag recall (the suspicious fields you caught) plus 40% flag precision (how many of your flags were real). Only logs you check without pressing Reveal count. Check 10 logs, at least one of them an attack, and you get a graded scorecard with a share link. The score is recomputed on the server from the same deterministic log set, so a saved card always matches what you flagged. The daily shift is the same set for everyone that UTC day. Every log is synthetic: no real devices, people or networks.

Attack types in this track

Malicious workload and execution

A pod, exec session or CronJob created by an identity that never deploys, often privileged or pulling a generic image.

  1. Capture the pod spec and logs, then delete or cordon the workload.
  2. Revoke the identity that created it and rotate its tokens.
  3. Search the audit log for everything else that identity did.

Container escape and node access

hostPath mounts of /, chroot into the host, privileged pods or an anonymous kubelet answering requests.

  1. Cordon and drain the node, keeping it for forensics rather than terminating it.
  2. Rotate kubelet and node credentials and any secret mounted on that node.
  3. Turn admission policies from audit to enforce.

RBAC and identity abuse

New cluster-admin bindings, service-account tokens used from outside, or a workload mapping its own permissions.

  1. Remove the binding and revert RBAC to the GitOps source.
  2. Rotate the affected service-account tokens and delete legacy secret tokens.
  3. Restrict API server access to known networks.

Secret and credential access

Secrets listed across namespaces by an app account, or node and workload cloud roles used from the internet.

  1. Rotate every secret the identity could read, starting with database and cloud credentials.
  2. Block pod access to the instance metadata service and use workload identity.
  3. Check cloud audit logs for what the stolen role touched.

Image and pipeline supply chain

Unsigned images, unknown registries, overwritten release tags or unreviewed code reaching a deploy step.

  1. Pin running workloads to the last known-good digest.
  2. Revoke the pusher's registry credentials and require signed images.
  3. Review pipeline triggers and secrets exposure for forks.

Resource hijacking and defence evasion

Mining processes pinning CPU, or runtime sensors and audit tooling deleted.

  1. Kill the workload and block the pool domains at egress.
  2. Restore the runtime sensor and alert on its removal.
  3. Find the entry point: the miner is the symptom, not the cause.

FAQ

Are these real cluster logs?

No. Every cluster, namespace, account, registry and IP is fictional and generated from a fixed seed. Field names follow what Kubernetes audit logs, admission controllers and runtime sensors typically record.

Is a privileged pod always an attack?

No. Network plugins and some node agents need it and run with documented exemptions in kube-system. It is a red flag when the creator, namespace or image does not fit.

Why does the source IP matter so much?

Service-account tokens and node roles are meant to be used from inside the cluster or cloud network. The same identity appearing from a public IP usually means the credential was copied out.

Why map Kubernetes events to ATT&CK Enterprise?

MITRE covers containers and orchestration inside the Enterprise matrix, in its Containers platform view, with techniques such as Deploy Container, Escape to Host and Container Administration Command.

What should I check first when I find a crypto miner?

How it got in. Mining is the payoff, so look for the exposed dashboard, leaked token, unsigned image or vulnerable app that let the workload start.

More security tools

The tools people use most on PlayCISO.

All tools
Prompt Scan

Catch injected instructions hiding in content your AI agent should only read.

ISO/IEC 27090 Readiness

Score your readiness against the first international standard for AI security threats.

CVE Trends

Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.

Firewall Lab

Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.

NIST CSF 2.0 Assessment

Self-assess all six Functions, from Govern to Recover, and see your weakest one.

APT Naming Rosetta Stone

Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.

🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. See the deal