Auditing processes and applications on Kubernetes worker nodes
Written by
Updated at October 19, 2026
This rule set covers the inventory and audit of various OS-level properties and components across Kubernetes worker nodes.
Intended only for collection of information, the rule set is not security standard compliant. For information analysis, you can use Yandex Audit Trails followed by export to SIEM/SOC systems.
| Rule | Check ID |
|---|---|
| OS-level sysctl parameter inventory | kspm.inventory.sysctl |
| OS user login inventory | kspm.inventory.logins |
| OS-level network settings inventory | kspm.inventory.network |
| OS-level shared memory inventory | kspm.inventory.shared-memory |
| Base OS property inventory | kspm.inventory.general |
| OS process inventory | kspm.inventory.processes |
| OS-level installed package inventory | kspm.inventory.apps |
| OS-level user inventory | kspm.inventory.users |
| OS-level APT repository inventory | kspm.inventory.apt-sources |
| OS-level AppArmor inventory | kspm.inventory.apparmor |
| Osquery agent self-monitoring inventory | kspm.inventory.selfmon |
| OS-level seccomp event inventory | kspm.inventory.seccomp |
| OS kernel inventory | kspm.inventory.kernel |