[Cloud Posture] EKS rule templates #3701

oren-zohar · 2022-07-13T14:18:44Z

What does this PR do?

Adding EKS benchmark rule templates

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
~~I have verified that all data streams collect metrics or logs.~~
I have added an entry to my package's changelog.yml file.
~~I have verified that Kibana version constraints are current according to guidelines.~~

Author's Checklist

Waiting for [Cloud Posture] add benchmark id to rule template #3654

Related issues

Closes: https://github.com/elastic/security-team/issues/4129

elasticmachine · 2022-07-13T14:29:53Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2022-07-14T15:14:20.956+0000
Duration: 16 min 3 sec

Test stats 🧪

Test	Results
Failed	0
Passed	1
Skipped	0
Total	1

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

oren-zohar · 2022-07-14T09:08:21Z

/test

kfirpeled · 2022-07-14T10:32:10Z

packages/cloud_security_posture/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.0.20"


nit we haven't promoted version 0.0.19 consider added the changes to that version backlog

see example here

@orouz's PR will add it, as seen in the description, I'm waiting for it to be merged

kfirpeled · 2022-07-14T10:32:29Z

...es/cloud_security_posture/kibana/csp_rule_template/0434fc0b-4b72-5a73-8bee-8c8c40345165.json

+        "API Server"
+      ],
+      "benchmark": {
+        "name": "CIS Kubernetes V1.23",


missing benchmark id "cis_k8s" - maybe you are missing a merge from main?

@orouz PR will add it

kfirpeled · 2022-07-14T10:33:05Z

packages/cloud_security_posture/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: cloud_security_posture
 title: "CIS Kubernetes Benchmark"
-version: 0.0.18
+version: 0.0.20


consider using version 0.0.19 instead

@orouz PR uses it already

# Conflicts: # packages/cloud_security_posture/changelog.yml # packages/cloud_security_posture/manifest.yml

elasticmachine · 2022-07-14T11:02:29Z

🌐 Coverage report

Name	Metrics % (`covered/total`)	Diff
Packages	100.0% (`0/0`)	💚
Files	100.0% (`0/0`)	💚 3.049
Classes	100.0% (`0/0`)	💚 3.049
Methods	33.333% (`1/3`)	👎 -55.875
Lines	100.0% (`0/0`)	💚 9.794
Conditionals	100.0% (`0/0`)	💚

# Conflicts: # packages/cloud_security_posture/changelog.yml

kfirpeled

missing version field

kfirpeled · 2022-07-14T11:46:31Z

...es/cloud_security_posture/kibana/csp_rule_template/8c4d1ae0-5f42-5ad0-a95d-27824a774951.json

+            "impact": "Removal of the read-only port will require that any service which made use of it will need to be re-configured to use the main Kubelet API.\n",
+            "default_value": "See the Amazon EKS documentation for the default value.\n",
+            "references": "1. https://kubernetes.io/docs/admin/kubelet/\n",
+            "section": "Kubelet",


missing version

kfirpeled · 2022-07-14T11:46:41Z

...es/cloud_security_posture/kibana/csp_rule_template/98524674-3de3-5424-9afa-ca763edca62a.json

+            "default_value": "See the Amazon EKS documentation for the default value.\n",
+            "references": "1. https://kubernetes.io/docs/admin/kubelet/\n2. https://github.com/kubernetes/kubernetes/issues/22063\n3. https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/\n",
+            "section": "Kubelet",
+            "tags": [


missing version

kfirpeled · 2022-07-14T11:46:53Z

...es/cloud_security_posture/kibana/csp_rule_template/c6bcde81-4ca4-5f6f-9ef0-1116b4a02f4c.json

+            "impact": "None\n",
+            "default_value": "See the Amazon EKS documentation for the default value.\n",
+            "references": "1. https://github.com/kubernetes/kubernetes/pull/45059\n2. https://kubernetes.io/docs/admin/kubelet-tls-bootstrapping/#kubelet-configuration\n",
+            "section": "Kubelet",


missing version

kfirpeled · 2022-07-14T11:47:03Z

...es/cloud_security_posture/kibana/csp_rule_template/d4eef2c6-599a-57d1-99dd-490d3745161d.json

+            "default_value": "See the Amazon EKS documentation for the default value.\n",
+            "references": "1. https://kubernetes.io/docs/admin/kubelet/ 2. https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/apis/kubeletconfig/v1beta1/types.go 3. https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/\n",
+            "section": "Kubelet",
+            "tags": [


missing version

kfirpeled · 2022-07-14T11:47:15Z

...es/cloud_security_posture/kibana/csp_rule_template/e9322670-79b9-5177-9fc0-388712f1df07.json

+            "default_value": "See the EKS documentation for the default value.\n",
+            "references": "1. https://kubernetes.io/docs/admin/kubelet/\n2. https://github.com/kubernetes/kubernetes/pull/18552\n",
+            "section": "Kubelet",
+            "tags": [


missing version

kfirpeled · 2022-07-14T11:47:21Z

...es/cloud_security_posture/kibana/csp_rule_template/efb2ffa2-28a9-558e-aba3-f58243cb3bbb.json

+            "default_value": "See the Amazon EKS documentation for the default value.\n",
+            "references": "1. https://github.com/kubernetes/kubernetes/pull/41912\n2. https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#kubelet-configuration\n3. https://kubernetes.io/docs/imported/release/notes/\n4. https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/\n5. https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/\n",
+            "section": "Kubelet",
+            "tags": [


missing version

…-rule-templates # Conflicts: # packages/cloud_security_posture/changelog.yml

kfirpeled

works for me locally
however we still have the same formatting issues like we had before
https://github.com/elastic/security-team/issues/3672

oren-zohar added 2 commits July 13, 2022 16:53

eks rules dump

3f8ba8f

changelog + benchmark_id

68e429c

oren-zohar added the enhancement New feature or request label Jul 13, 2022

changelog update

cb95626

reformat all json objects

cf77805

oren-zohar marked this pull request as ready for review July 14, 2022 10:27

oren-zohar requested a review from a team as a code owner July 14, 2022 10:27

kfirpeled reviewed Jul 14, 2022

View reviewed changes

oren-zohar added 2 commits July 14, 2022 13:41

reformat all json objects

ab481ac

Merge remote-tracking branch 'upstream/main' into eks-rule-templates

53c3f67

# Conflicts: # packages/cloud_security_posture/changelog.yml # packages/cloud_security_posture/manifest.yml

oren-zohar and others added 4 commits July 14, 2022 14:05

0.0.20 -> 0.0.19

8f53c7d

0.0.20 -> 0.0.19

eb951d6

Merge branch 'main' into eks-rule-templates

083ae16

Merge remote-tracking branch 'upstream/main' into eks-rule-templates

097134f

# Conflicts: # packages/cloud_security_posture/changelog.yml

kfirpeled reviewed Jul 14, 2022

View reviewed changes

oren-zohar added 2 commits July 14, 2022 18:13

version

ffcfd0e

Merge remote-tracking branch 'oren-zohar/eks-rule-templates' into eks…

dbbccbd

…-rule-templates # Conflicts: # packages/cloud_security_posture/changelog.yml

oren-zohar requested a review from kfirpeled July 14, 2022 15:36

kfirpeled approved these changes Jul 14, 2022

View reviewed changes

kfirpeled merged commit e4ddfbe into elastic:main Jul 14, 2022

oren-zohar deleted the eks-rule-templates branch July 18, 2022 13:33

kfirpeled added the Team:Cloud Security Label for the Cloud Security team [elastic/cloud-security-posture] label Jun 26, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Cloud Posture] EKS rule templates #3701

[Cloud Posture] EKS rule templates #3701

oren-zohar commented Jul 13, 2022 •

edited

Loading

elasticmachine commented Jul 13, 2022 •

edited

Loading

Build stats

Test stats 🧪

oren-zohar commented Jul 14, 2022

kfirpeled Jul 14, 2022

oren-zohar Jul 14, 2022

kfirpeled Jul 14, 2022

oren-zohar Jul 14, 2022

kfirpeled Jul 14, 2022

oren-zohar Jul 14, 2022

elasticmachine commented Jul 14, 2022 •

edited

Loading

kfirpeled left a comment

kfirpeled Jul 14, 2022

kfirpeled Jul 14, 2022

kfirpeled Jul 14, 2022

kfirpeled Jul 14, 2022

kfirpeled Jul 14, 2022

kfirpeled Jul 14, 2022

kfirpeled left a comment

		@@ -1,4 +1,9 @@
		# newer versions go on top
		- version: "0.0.20"

[Cloud Posture] EKS rule templates #3701

[Cloud Posture] EKS rule templates #3701

Conversation

oren-zohar commented Jul 13, 2022 • edited Loading

What does this PR do?

Checklist

Author's Checklist

Related issues

elasticmachine commented Jul 13, 2022 • edited Loading

💚 Build Succeeded

Build stats

Test stats 🧪

🤖 GitHub comments

oren-zohar commented Jul 14, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Jul 14, 2022 • edited Loading

🌐 Coverage report

kfirpeled left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kfirpeled left a comment

Choose a reason for hiding this comment

oren-zohar commented Jul 13, 2022 •

edited

Loading

elasticmachine commented Jul 13, 2022 •

edited

Loading

elasticmachine commented Jul 14, 2022 •

edited

Loading