A field note on joining cloud, Kubernetes audit, admission, and runtime evidence during investigation.
The events between the layers
Test whether your evidence can reconstruct these representative actions across layers.
- An exec session into a running pod.
- A service-account token request.
- An admission rejection.
- A secret read followed by an outbound connection.
- A privileged ephemeral container addition.
Design the join before the alert
Choose stable fields that connect cloud identity, Kubernetes user information, workload metadata, and runtime process context. Validate field availability at the audit level you actually retain.
Run a field test
Execute one approved test per event, preserve the timestamps, and ask an analyst to reconstruct it without hints. Record missing sources and ambiguous identity transitions as control defects.