drop k3s audit log · parse api server events
flags secret list/get bursts · clusterrolebinding changes · exec into kube-system · timeline + actor rollup
heuristic screener · k3s audit format varies by version and install — not definitive proof