> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/kubernetes-audit-logs.md).

# Kubernetes Audit Logs

Alerts related to data source "Kubernetes Audit Logs".

| Alert                                                                                                                                                                                            |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| [A cloud identity executed an API call from an unusual country](/analytics-alerts/alerts-by-name/a-cloud-identity-executed-an-api-call-from-an-unusual-country.md)                               |
| [A container registry was created or deleted](/analytics-alerts/alerts-by-name/a-container-registry-was-created-or-deleted.md)                                                                   |
| [A Kubernetes API operation was successfully invoked by an anonymous user](/analytics-alerts/alerts-by-name/a-kubernetes-api-operation-was-successfully-invoked-by-an-anonymous-user.md)         |
| [A Kubernetes cluster role binding was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-cluster-role-binding-was-created-or-deleted.md)                                         |
| [A Kubernetes cluster role was created](/analytics-alerts/alerts-by-name/a-kubernetes-cluster-role-was-created.md)                                                                               |
| [A Kubernetes cluster was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-cluster-was-created-or-deleted.md)                                                                   |
| [A Kubernetes ConfigMap was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-configmap-was-created-or-deleted.md)                                                               |
| [A Kubernetes Cronjob was created](/analytics-alerts/alerts-by-name/a-kubernetes-cronjob-was-created.md)                                                                                         |
| [A Kubernetes DaemonSet was created](/analytics-alerts/alerts-by-name/a-kubernetes-daemonset-was-created.md)                                                                                     |
| [A Kubernetes dashboard service account was used outside the cluster](/analytics-alerts/alerts-by-name/a-kubernetes-dashboard-service-account-was-used-outside-the-cluster.md)                   |
| [A Kubernetes deployment was created](/analytics-alerts/alerts-by-name/a-kubernetes-deployment-was-created.md)                                                                                   |
| [A Kubernetes ephemeral container was created](/analytics-alerts/alerts-by-name/a-kubernetes-ephemeral-container-was-created.md)                                                                 |
| [A Kubernetes namespace was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-namespace-was-created-or-deleted.md)                                                               |
| [A Kubernetes node service account activity from external IP](/analytics-alerts/alerts-by-name/a-kubernetes-node-service-account-activity-from-external-ip.md)                                   |
| [A Kubernetes Pod was created with a sidecar container](/analytics-alerts/alerts-by-name/a-kubernetes-pod-was-created-with-a-sidecar-container.md)                                               |
| [A Kubernetes Pod was deleted](/analytics-alerts/alerts-by-name/a-kubernetes-pod-was-deleted.md)                                                                                                 |
| [A Kubernetes ReplicaSet was created](/analytics-alerts/alerts-by-name/a-kubernetes-replicaset-was-created.md)                                                                                   |
| [A Kubernetes role binding was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-role-binding-was-created-or-deleted.md)                                                         |
| [A Kubernetes secret was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-secret-was-created-or-deleted.md)                                                                     |
| [A Kubernetes service account executed an unusual API call](/analytics-alerts/alerts-by-name/a-kubernetes-service-account-executed-an-unusual-api-call.md)                                       |
| [A Kubernetes service account has enumerated its permissions](/analytics-alerts/alerts-by-name/a-kubernetes-service-account-has-enumerated-its-permissions.md)                                   |
| [A Kubernetes service account was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-service-account-was-created-or-deleted.md)                                                   |
| [A Kubernetes service was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-service-was-created-or-deleted.md)                                                                   |
| [A Kubernetes StatefulSet was created](/analytics-alerts/alerts-by-name/a-kubernetes-statefulset-was-created.md)                                                                                 |
| [Denied API call by a Kubernetes service account](/analytics-alerts/alerts-by-name/denied-api-call-by-a-kubernetes-service-account.md)                                                           |
| [Kubernetes admission controller activity](/analytics-alerts/alerts-by-name/kubernetes-admission-controller-activity.md)                                                                         |
| [Kubernetes cluster events deletion](/analytics-alerts/alerts-by-name/kubernetes-cluster-events-deletion.md)                                                                                     |
| [Kubernetes enumeration activity](/analytics-alerts/alerts-by-name/kubernetes-enumeration-activity.md)                                                                                           |
| [Kubernetes network policy modification](/analytics-alerts/alerts-by-name/kubernetes-network-policy-modification.md)                                                                             |
| [Kubernetes Pod Created with host Inter Process Communications (IPC) namespace](/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-inter-process-communications-ipc-namespace.md) |
| [Kubernetes Pod created with host process ID (PID) namespace](/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-process-id-pid-namespace.md)                                     |
| [Kubernetes Pod Created With Sensitive Volume](/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-sensitive-volume.md)                                                                 |
| [Kubernetes pod creation from unknown container image registry](/analytics-alerts/alerts-by-name/kubernetes-pod-creation-from-unknown-container-image-registry.md)                               |
| [Kubernetes pod creation with host network](/analytics-alerts/alerts-by-name/kubernetes-pod-creation-with-host-network.md)                                                                       |
| [Kubernetes Privileged Pod Creation](/analytics-alerts/alerts-by-name/kubernetes-privileged-pod-creation.md)                                                                                     |
| [Kubernetes secrets enumeration for the first time](/analytics-alerts/alerts-by-name/kubernetes-secrets-enumeration-for-the-first-time.md)                                                       |
| [Kubernetes service account activity outside the cluster](/analytics-alerts/alerts-by-name/kubernetes-service-account-activity-outside-the-cluster.md)                                           |
| [Kubernetes vulnerability scanning tool usage](/analytics-alerts/alerts-by-name/kubernetes-vulnerability-scanning-tool-usage.md)                                                                 |
| [Suspicious API call from a Tor exit node](/analytics-alerts/alerts-by-name/suspicious-api-call-from-a-tor-exit-node.md)                                                                         |
| [Unusual exec into a Kubernetes Pod](/analytics-alerts/alerts-by-name/unusual-exec-into-a-kubernetes-pod.md)                                                                                     |
| [Unusual Kubernetes secret access](/analytics-alerts/alerts-by-name/unusual-kubernetes-secret-access.md)                                                                                         |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/kubernetes-audit-logs.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.