Skill UI

A comprehensive security auditing tool designed to identify over-permissive Role-Based Access Control (RBAC) roles and potential service-account token abuse paths within a Kubernetes cluster. It systematically reviews cluster bindings, effective permissions, and common escalation primitives using advanced tools like `kubectl auth can-i`, `rbac-police`, and `rakkess`, ensuring adherence to the principle of least privilege.

kube-bench is an open-source tool that validates the compliance and security posture of Kubernetes clusters. It rigorously checks control-plane components, worker nodes, and cluster policies against the comprehensive CIS Kubernetes Benchmark. It reports findings (PASS/FAIL/WARN) and includes specific remediation guidance, making it essential for compliance auditing and hardening efforts.

Falco is a powerful CNCF project for real-time runtime security monitoring. This guide teaches authors how to write and deploy custom detection rules using Falco's robust YAML rule engine and modern eBPF driver. It is designed to detect critical threats such as container escapes, namespace manipulation, privileged mounts, and anomalous syscalls in Kubernetes and Docker environments, significantly hardening the overall container security posture.

Stratus Red Team is an open-source tool designed for detection engineering and purple teaming. It programmatically detonates granular, documented offensive techniques across major cloud platforms (AWS, Azure, GCP, and Kubernetes). It validates existing security detections (like CloudTrail/GuardDuty) by simulating real attacker activity in a controlled, reversible environment. The tool ensures deterministic lifecycles, guaranteeing that all created resources are cleaned up after testing.

Trivy is an open-source, comprehensive scanner used to find vulnerabilities (CVEs), misconfigurations, secrets, and license issues across multiple targets. It is essential for implementing 'shift-left' security gates in CI/CD pipelines, scanning container images, Infrastructure-as-Code (IaC) like Terraform/Kubernetes, and generating/re-scanning SBOMs for supply chain transparency.

This tool diagnoses and validates complex cron expressions (e.g., crontab, Kubernetes CronJob) to prevent silent scheduling failures. It identifies five common pitfalls: impossible dates, misunderstood OR semantics, resource spikes, uneven step drift, and leap year issues. Users can check the syntax, understand the true meaning, and calculate future execution times reliably.

KubeEye is a comprehensive cluster inspection tool designed for Kubernetes environments, particularly within KubeSphere. It systematically detects issues across workloads, nodes, and configurations by integrating multiple policy engines, including OPA/Rego, PromQL, file integrity checks, kernel parameter validation, and systemd health checks. Users can define custom inspection rules (InspectRule), schedule checks (InspectPlan), and retrieve detailed reports (InspectResult) to ensure cluster compliance and stability.