Azure Kubernetes Service (AKS) - Atatus Docs

Overview

The Azure Kubernetes Service (AKS) integration ingests AKS control plane diagnostic logs:

kube-apiserver: API server requests
kube-audit and kube-audit-admin: audit decisions
kube-controller-manager and kube-scheduler
cluster-autoscaler events
guard (AAD authorization) decisions

Prerequisites

An AKS cluster with diagnostic settings routing the desired log categories to a Log Analytics workspace.
An Azure AD app registration with permission to read those logs (Reader on the resource group or Log Analytics Reader on the workspace).

Step 1: Enable AKS diagnostic settings

In the Azure portal, open your AKS cluster.
Go to Monitoring → Diagnostic settings → Add diagnostic setting.
Select log categories such as kube-apiserver, kube-audit, kube-audit-admin, kube-controller-manager, kube-scheduler, cluster-autoscaler, guard.
Choose Send to Log Analytics workspace and select your workspace.
Click Save.

Step 2: Register an app in Azure AD

Open Microsoft Entra ID → App registrations → New registration.
Name it atatus-aks-reader and click Register.
Copy the Application (client) ID and Directory (tenant) ID.
Under Certificates & secrets, create a new client secret and copy its Value.

Step 3: Grant the app access to the cluster

Open the AKS cluster’s Resource group → Access control (IAM) → Add role assignment.
Assign the role Log Analytics Reader (or Reader if you also want resource metadata) to the app from Step 2.

Step 4: Connect Azure AKS in Atatus

In Atatus, go to Security → Cloud SIEM → Integrations.
Locate the Azure Kubernetes Service (AKS) card and click Connect.
Fill in the form:

Field	Description	Example
Azure Client ID	App registration client ID.	`11111111-1111-1111-1111-111111111111`
Azure Client Secret	The client secret value.	`••••••••`
Tenant ID	Directory (tenant) ID.	`00000000-0000-0000-0000-000000000000`
Subscription ID	Subscription containing the cluster.	`22222222-2222-2222-2222-222222222222`
Resource Group	Resource group of the cluster.	`my-resource-group`
Cluster Name	AKS cluster name.	`my-aks-cluster`
Poll Interval (minutes)	How often to fetch new entries.	`5`

Click Connect.

Verification

The AKS card shows Configured.
Control plane events appear in Security → Cloud SIEM → Audit Logs → Events with source azure_aks.