ingest-k8s-audit-ocsf

Thin, single-purpose ingestion skill: raw Kubernetes audit logs in → OCSF 1.8 API Activity JSONL out by default, with an optional native enriched event shape when --output-format native is selected. No detection logic, no K8s API calls, no side effects.

Wire contract

Reads the audit.k8s.io/v1 Event object that kube-apiserver writes to its audit sink: