How to correlate Kubernetes audit logs with container runtime data

This post explains how to correlate Kubernetes audit logs and Elastic Defend for Containers (D4C) telemetry to detect and investigate container compromises. It describes two primary join methods (pod caller identity and service-account + objectRef), lists shared join keys and one-sided context fields, provides example EQL/ES|QL queries, and walks a lab scenario where a compromised service account reads secrets, performs TokenRequest, creates a privileged breakout pod, execs into it, and attempts a host escape (nsenter/chroot) while also querying cloud metadata endpoints.