AKS Container Insights and Pod Telemetry

Location

Description

Runtime telemetry for AKS pods and nodes including container stdout/stderr logs, pod inventory changes, namespace placement, image names, restart activity, and Kubernetes event streams.

Forensic Value

Container telemetry links control-plane actions to runtime behavior. It exposes suspicious images pulled into the cluster, ephemeral attacker pods, repeated crash loops caused by tampering, exec-based troubleshooting shells, and workloads that contacted unexpected destinations. Combined with Kubernetes audit logs, Container Insights reconstructs both who launched a workload and what it did after launch.

Tools Required

Collection Commands

ContainerLogV2 | where TimeGenerated > ago(7d) | project TimeGenerated, PodNamespace, PodName, ContainerName, LogMessage

KubePodInventory | where TimeGenerated > ago(7d) | project TimeGenerated, Namespace, PodName, ContainerName, ContainerID, Image, PodStatus

KubeEvents | where TimeGenerated > ago(7d) | project TimeGenerated, Namespace, Name, Reason, Message

MITRE ATT&CK Techniques