Overview

The Azure Kubernetes Service (AKS) integration ingests AKS control plane diagnostic logs:

• kube-apiserver — API server requests
• kube-audit and kube-audit-admin — audit decisions
• kube-controller-manager and kube-scheduler
• cluster-autoscaler events
• guard (AAD authorization) decisions

Prerequisites

• An AKS cluster with diagnostic settings routing the desired log categories to a Log Analytics workspace.
• An Azure AD app registration with permission to read those logs (Reader on the resource group or Log Analytics Reader on the workspace).

Step 1: Enable AKS diagnostic settings

1. In the Azure portal, open your AKS cluster.
2. Go to Monitoring → Diagnostic settings → Add diagnostic setting.
3. Select log categories such as kube-apiserver, kube-audit, kube-audit-admin, kube-controller-manager, kube-scheduler, cluster-autoscaler, guard.
4. Choose Send to Log Analytics workspace and select your workspace.
5. Click Save.

Step 2: Register an app in Azure AD

1. Open Microsoft Entra ID → App registrations → New registration.
2. Name it atatus-aks-reader and click Register.
3. Copy the Application (client) ID and Directory (tenant) ID.
4. Under Certificates & secrets, create a new client secret and copy its Value.

Step 3: Grant the app access to the cluster

1. Open the AKS cluster's Resource group → Access control (IAM) → Add role assignment.
2. Assign the role Log Analytics Reader (or Reader if you also want resource metadata) to the app from Step 2.

Step 4: Connect Azure AKS in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the Azure Kubernetes Service (AKS) card and click Connect.
3. Fill in the form:

1. Click Connect.

Verification

• The AKS card shows Configured.
• Control plane events appear in Security → Cloud SIEM → Audit Logs → Events with source azure_aks.