Kubernetes API audit event

Kubernetes API audit event. API-server audit Event describing a request stage.

Source and collection

kube-apiserver audit backend or managed-cluster export.

Configure audit policy and backend; inspect level, stage, omitted stages and sensitive payload controls.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 1 properties.log

Decoded Azure envelope properties.log; native Kubernetes audit JSON preserved.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: c8ee8d452e5a057a8b80795b29259cdf6f94d37d15908f9888c36caf0196a466

{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"ad26f7bc-f1c6-4097-90f1-e0924e12f257","stage":"ResponseComplete","requestURI":"/apis/coordination.k8s.io/v1/namespaces/kube-system/leases/kubelet-serving-csr-approver","verb":"update","user":{"username":"aksService","groups":["system:masters","system:authenticated"]},"sourceIPs":["172.31.51.172"],"userAgent":"approver/v0.0.0 (linux/amd64) kubernetes/$Format/leader-election","objectRef":{"resource":"leases","namespace":"kube-system","name":"kubelet-serving-csr-approver","uid":"14be99f8-ebb7-47b9-a194-43e63d9386af","apiGroup":"coordination.k8s.io","apiVersion":"v1","resourceVersion":"93076016"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2025-10-07T16:19:19.643609Z","stageTimestamp":"2025-10-07T16:19:19.647762Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":""}}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`kind`	str
`apiVersion`	str
`level`	str
`auditID`	str
`stage`	str
`requestURI`	str
`verb`	str
`user.username`	str
`user.groups`	array
`user.groups[0]`	str
`sourceIPs`	array
`sourceIPs[0]`	str
`userAgent`	str
`objectRef.resource`	str
`objectRef.namespace`	str
`objectRef.name`	str
`objectRef.uid`	str
`objectRef.apiGroup`	str
`objectRef.apiVersion`	str
`objectRef.resourceVersion`	str
`responseStatus.code`	int
`requestReceivedTimestamp`	str
`stageTimestamp`	str
`annotations.authorization.k8s.io/decision`	str
`annotations.authorization.k8s.io/reason`	str

auditID: Correlates stages for an API request.
stage: Request processing stage.
level: Audit detail selected by policy.
user: Authenticated user context.
objectRef: Target object when available.

Investigation uses

Correlate auditID across stages and inspect verb, user, objectRef and responseStatus.
Review privileged resource changes and unexpected service-account activity.

Validation boundaries

RequestReceived does not prove completion; RequestResponse can expose secrets. Policy determines what is retained.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Falco JSON alert

Ecosystem connections

References

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.