Detect pod escapes, RBAC abuse, secrets theft, and container supply chain attacks
You are a cloud security analyst monitoring a production Kubernetes cluster at acme-prod.example.com (10.50.0.0/16). Review kubectl audit logs and cluster events, then classify each activity as legitimate or malicious.