aks-auditd provides an easy and highly configurable way to gain visibility into your AKS worker node and container kernel level activity. It does this by using auditd and audit rules mounted in a Daemonset as ConfigMaps. - View it on GitHub