Skip to content

Commit 9d5aa09

Browse files
mergify[bot]benironside
mergify[bot]
and
benironside
authored
[DOCS] KSPM docs reorg (#2539) (#2582)
* KSPM docs reorg * Attempts to fix build error and removes outdated part of Benchmarks page * Fixes build error * testing build error * tests docs build * Takes another approach to build problems * Updates //comment * Update section headings for subordination * make dashboard page subordinate to KSPM page * Update docs/cloud-native-security/kspm.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/cloud-native-security/kspm.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/cloud-native-security/kspm.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/cloud-native-security/kspm.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Update docs/cloud-native-security/kspm.asciidoc Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Adds ToC and creates "Getting started" page * troubleshoots ToC issue * adds missing anchor * fixes build error * Add AWS auth details * troubleshoot headings/docs ToC * Minor fixes * minor updates * Update docs/cloud-native-security/benchmark-rules.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/cloud-nat-sec-posture-dashboard.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/cloud-native-security-index.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/findings.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/findings.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/get-started-with-kspm.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/get-started-with-kspm.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/get-started-with-kspm.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/get-started-with-kspm.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/get-started-with-kspm.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/findings.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/get-started-with-kspm.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/get-started-with-kspm.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/get-started-with-kspm.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/get-started-with-kspm.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/get-started-with-kspm.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/get-started-with-kspm.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/get-started-with-kspm.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Update docs/cloud-native-security/get-started-with-kspm.asciidoc Co-authored-by: Joe Peeples <joe.peeples@elastic.co> * Incorporates Joe's and Nastasha's feedback. * maintains dashboard doc parity * minor change * Incorporates Janeen's and Tinsae's feedback * minor fixes Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> Co-authored-by: Joe Peeples <joe.peeples@elastic.co> (cherry picked from commit 1ac0a00) Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>
1 parent aae07a6 commit 9d5aa09

File tree

7 files changed

+272
-45
lines changed

7 files changed

+272
-45
lines changed

‎docs/cloud-native-security/benchmark-rules.asciidoc‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
11
[[benchmark-rules]]
2-
= Benchmark rules
3-
The Benchmark Integrations page lets you view and manage cloud security posture (CSP) benchmark rules for each of your <<kspm, Kubernetes security posture management (KSPM) integrations>>. Enabled benchmark rules define the Kubernetes configuration best practices that form the basis of the data that appears on the <<cloud-posture-dashboard, Cloud Posture dashboard>>.
2+
== Benchmark rules
3+
The Benchmark Integrations page lets you view the cloud security posture (CSP) benchmark rules for your <<kspm, Kubernetes security posture management (KSPM) integrations>>. Benchmark rules define the Kubernetes configuration best practices that form the basis of the data that appears on the <<cloud-posture-dashboard, Cloud Posture dashboard>>.
44

55
To find the Benchmark Integrations page, go to **Manage -> CSP Benchmarks**. From there, to view the benchmark rules associated with an integration, select that integration's name.
66

7-
image::images/benchmark-rules.png[The Benchmark rules page]
7+
[role="screenshot"]
8+
image::images/benchmark-rules.png[Benchmark rules page]
89

910
You can then click on a benchmark rule's name to see details, including information about how to remediate failures and related links.
1011

11-
You can enable or disable benchmark rules for each integration, either individually or in bulk using the *Bulk Actions* menu. By default, benchmark rules are enabled.
12-
1312
NOTE: Benchmark rules are not editable.

‎docs/cloud-native-security/cloud-nat-sec-posture-dashboard.asciidoc‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
[[cloud-nat-sec-posture-dashboard]]
2+
// Note: This page is intentionally duplicated by docs/dashboards/cloud-posture.asciidoc. When you update this page, update that page to match.
3+
4+
== Cloud Posture dashboard
5+
6+
The Cloud Posture dashboard summarizes how your Kubernetes configuration measures up to security benchmarks.
7+
8+
NOTE: To learn how to collect this data, refer to <<kspm, Kubernetes security posture management>>.
9+
10+
[role="screenshot"]
11+
image::images/cloud-sec-dashboard.png[Cloud Security dashboard]
12+
13+
The first row of cards (Cloud Posture Score, Failed Findings, and Open Cases) summarizes your overall cloud security posture (CSP) by aggregating data from all monitored Kubernetes clusters. Each subsequent row summarizes the posture of an individual Kubernetes cluster.
14+
15+
The Cloud Posture Score card shows the performance of your Kubernetes clusters on <<benchmark-rules,security benchmarks>>. Hover over the card to display when the data was collected.
16+
17+
The Failed Findings card shows failed findings grouped by Center for Internet Security (CIS) benchmark categories. Click any section name to view its failed findings on the <<findings-page, Findings page>>.

‎docs/cloud-native-security/cloud-native-security-index.asciidoc‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
[[cloud-native-security-overview]]
22

33
= Cloud native security
4-
Elastic’s cloud security capabilities help you to improve your Kubernetes security posture by comparing your configuration to best practices, and help you monitor and investigate your Linux deployments inside and outside of Kubernetes.
4+
Elastic’s cloud security capabilities help you to improve your Kubernetes security posture by comparing your configuration to best practices, and allow you to monitor and investigate your Linux deployments inside and outside of Kubernetes.
55

66
include::kspm.asciidoc[leveloffset=+1]
7+
include::get-started-with-kspm.asciidoc[leveloffest=+1]
8+
include::findings.asciidoc[leveloffset=+1]
79
include::benchmark-rules.asciidoc[leveloffset=+1]
10+
include::cloud-nat-sec-posture-dashboard.asciidoc[leveloffset=+1]

‎docs/cloud-native-security/findings.asciidoc‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
[[findings-page]]
2+
== Findings page
3+
4+
[role="screenshot"]
5+
image::images/findings-page.png[Findings page]
6+
7+
The Findings page shows how your Kubernetes clusters' configuration measures up to the standards defined on the <<benchmark-rules, CSP Benchmarks page>>.
8+
9+
Findings are organized by the resource IDs of the associated Kubernetes infrastructure and include data about the infrastructure and benchmark rules. Each finding's result (`pass` or `fail`) indicates whether a particular part of your Kubernetes infrastructure meets an active CSP benchmark rule.
10+
11+
You can filter table data by entering queries into the KQL search bar.

‎docs/cloud-native-security/get-started-with-kspm.asciidoc‎

Lines changed: 227 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,227 @@
1+
[[get-started-with-kspm]]
2+
=== Get started with KSPM
3+
This page explains how to configure the Kubernetes Security Posture Management integration.
4+
5+
The instructions differ depending on whether you're installing on EKS or on unmanaged clusters.
6+
7+
* Install on EKS-managed clusters:
8+
. <<kspm-setup-eks-start,Name your integration and select a Kubernetes deployment type>>
9+
. <<kspm-setup-eks-auth,Authenticate to AWS>>
10+
. <<kspm-setup-eks-finish,Finish configuring the KSPM integration>>
11+
. <<kspm-setup-eks-modify-deploy,Deploy the DaemonSet to your clusters>>
12+
13+
14+
* Install on unmanaged clusters:
15+
. <<kspm-setup-unmanaged,Configure the KSPM integration>>
16+
. <<kspm-setup-unmanaged-modify-deploy,Deploy the DaemonSet manifest to your clusters>>
17+
18+
[discrete]
19+
[[kspm-setup-eks-start]]
20+
=== Set up KSPM for Amazon EKS clusters
21+
22+
[discrete]
23+
==== Name your integration and select a Kubernetes Deployment type
24+
25+
1. Go to *Dashboards -> Cloud Posture*.
26+
2. Click *Add a KSPM integration*.
27+
3. Read the integration's description to understand how it works. Then, click *Add Kubernetes Security Posture Management*.
28+
4. Name your integration. Use a name that matches the purpose or team of the cluster(s) you want to monitor, for example, `IT-dev-k8s-clusters`.
29+
5. Select *EKS* from the *Kubernetes Deployment* menu. A new section for AWS credentials will appear.
30+
31+
[discrete]
32+
[[kspm-setup-eks-auth]]
33+
==== Authenticate to AWS
34+
35+
There are several options for how to provide AWS credentials:
36+
37+
* <<kspm-use-keys-directly,Use access keys directly>>
38+
* <<kspm-use-temp-credentials,Use temporary security credentials>>
39+
* <<kspm-use-a-shared-credentials-file,Use a shared credentials file>>
40+
* <<kspm-use-iam-arn,Use an IAM role ARN>>
41+
42+
Regardless of which option you use, you'll need to grant the following permissions:
43+
44+
45+
46+
[source,console]
47+
----------------------------------
48+
ecr:GetRegistryPolicy,
49+
eks:ListTagsForResource
50+
elasticloadbalancing:DescribeTags
51+
ecr-public:DescribeRegistries
52+
ecr:DescribeRegistry
53+
elasticloadbalancing:DescribeLoadBalancerPolicyTypes
54+
ecr:ListImages
55+
ecr-public:GetRepositoryPolicy
56+
elasticloadbalancing:DescribeLoadBalancerAttributes
57+
elasticloadbalancing:DescribeLoadBalancers
58+
ecr-public:DescribeRepositories
59+
eks:DescribeNodegroup
60+
ecr:DescribeImages
61+
elasticloadbalancing:DescribeLoadBalancerPolicies
62+
ecr:DescribeRepositories
63+
eks:DescribeCluster
64+
eks:ListClusters
65+
elasticloadbalancing:DescribeInstanceHealth
66+
ecr:GetRepositoryPolicy
67+
----------------------------------
68+
69+
If you are using the AWS visual editor to create and modify your IAM Policies, you can copy and paste this IAM policy JSON object:
70+
71+
.Click to view JSON object
72+
[%collapsible]
73+
====
74+
```
75+
{
76+
"Version": "2012-10-17",
77+
"Statement": [
78+
{
79+
"Sid": "VisualEditor0",
80+
"Effect": "Allow",
81+
"Action": [
82+
"ecr:GetRegistryPolicy",
83+
"eks:ListTagsForResource",
84+
"elasticloadbalancing:DescribeTags",
85+
"ecr-public:DescribeRegistries",
86+
"ecr:DescribeRegistry",
87+
"elasticloadbalancing:DescribeLoadBalancerPolicyTypes",
88+
"ecr:ListImages",
89+
"ecr-public:GetRepositoryPolicy",
90+
"elasticloadbalancing:DescribeLoadBalancerAttributes",
91+
"elasticloadbalancing:DescribeLoadBalancers",
92+
"ecr-public:DescribeRepositories",
93+
"eks:DescribeNodegroup",
94+
"ecr:DescribeImages",
95+
"elasticloadbalancing:DescribeLoadBalancerPolicies",
96+
"ecr:DescribeRepositories",
97+
"eks:DescribeCluster",
98+
"eks:ListClusters",
99+
"elasticloadbalancing:DescribeInstanceHealth",
100+
"ecr:GetRepositoryPolicy"
101+
],
102+
"Resource": "*"
103+
}
104+
]
105+
}
106+
```
107+
====
108+
109+
[discrete]
110+
[[kspm-use-keys-directly]]
111+
===== Option 1 - Use access keys directly
112+
Access keys are long-term credentials for an IAM user or the AWS account root user. To use access keys as credentials, you need to provide the `Access key ID` and the `Secret Access Key`.
113+
114+
For more details, refer to AWS' https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html[Access Keys and Secret Access Keys] documentation.
115+
116+
IMPORTANT: You must select "Programmatic access" when creating the IAM user.
117+
118+
[discrete]
119+
[[kspm-use-temp-credentials]]
120+
===== Option 2 - Use temporary security credentials
121+
You can configure temporary security credentials in AWS to last for a specified duration. They consist of an access key ID, a secret access key, and a security token, which is typically found using `GetSessionToken`.
122+
123+
Because temporary security credentials are short term, once they expire, you will need to generate new ones and manually update the integration's configuration to continue collecting cloud posture data. Update the credentials before they expire to avoid data loss.
124+
125+
NOTE: IAM users with multi-factor authentication (MFA) enabled need to submit an MFA code when calling `GetSessionToken`. For more details, refer to AWS' https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html[Temporary Security Credentials] documentation.
126+
127+
You can use the AWS CLI to generate temporary credentials. For example, you could use the following command if you have MFA enabled:
128+
129+
[source,console]
130+
----------------------------------
131+
`sts get-session-token --serial-number arn:aws:iam::1234:mfa/your-email@example.com --duration-seconds 129600 --token-code 123456`
132+
----------------------------------
133+
134+
The output from this command includes the following fields, which you should provide when configuring the KSPM integration:
135+
136+
* `Access key ID`: The first part of the access key.
137+
* `Secret Access Key`: The second part of the access key.
138+
* `Session Token`: A token required when using temporary security credentials.
139+
140+
[discrete]
141+
[[kspm-use-a-shared-credentials-file]]
142+
===== Option 3 - Use a shared credentials file
143+
If you use different AWS credentials for different tools or applications, you can use profiles to define multiple access keys in the same configuration file. For more details refer to AWS' https://docs.aws.amazon.com/sdkref/latest/guide/file-format.html[Shared Credentials Files] documentation.
144+
145+
Instead of providing the `Access key ID` and `Secret Access Key` to the integration, provide the information required to locate the access keys within the shared credentials file:
146+
147+
* `Credential Profile Name`: The profile name in the shared credentials file.
148+
* `Shared Credential File`: The directory of the shared credentials file.
149+
150+
If you don't provide values for all configuration fields, the integration will use these defaults:
151+
152+
- If `Access key ID`, `Secret Access Key`, and `ARN Role` are not provided, then the integration will check for `Credential Profile Name`.
153+
- If there is no `Credential Profile Name`, the default profile will be used.
154+
- If `Shared Credential File` is empty, the default directory will be used.
155+
- For Linux or Unix, the shared credentials file is located at `~/.aws/credentials`.
156+
157+
[discrete]
158+
[[kspm-use-iam-arn]]
159+
===== Option 4 - Use an IAM role Amazon Resource Name (ARN)
160+
An IAM role Amazon Resource Name (ARN) is an IAM identity that you can create in your AWS account. You define the role's permissions.
161+
Roles do not have standard long-term credentials such as passwords or access keys.
162+
Instead, when you assume a role, it provides you with temporary security credentials for your session.
163+
An IAM role's ARN can be used to specify which AWS IAM role to use to generate temporary credentials.
164+
165+
For more details, refer to AWS' https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html[AssumeRole API] documentation.
166+
Follow AWS' instructions to https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html[create an IAM user], and define the IAM role's permissions using the JSON permissions policy above.
167+
168+
To use an IAM role's ARN, you need to provide either a <<kspm-use-a-shared-credentials-file,credential profile>> or <<kspm-use-keys-directly,access keys>> along with the `ARN role`.
169+
The `ARN Role` value specifies which AWS IAM role to use for generating temporary credentials.
170+
171+
NOTE: If `ARN Role` is present, the integration will check if `Access key ID` and `Secret Access Key` are present.
172+
If not, the package will check for a `Credential Profile Name`.
173+
If a `Credential Profile Name` is not present, the default credential profile will be used.
174+
175+
176+
[[kspm-setup-eks-finish]]
177+
[discrete]
178+
==== Finish configuring the KSPM integration for EKS
179+
Once you've provided AWS credentials, finish configuring the KSPM integration:
180+
181+
1. If you want to monitor Kubernetes clusters that aren’t yet enrolled in {fleet}, select *New Hosts* under “where to add this integration”.
182+
2. Name the {agent} policy. Use a name that matches the purpose or team of the cluster(s) you want to monitor. For example, `IT-dev-k8s-clusters`.
183+
3. Click *Save and continue*, then *Add agent to your hosts*. The *Add agent* wizard appears and provides a DaemonSet manifest `.yaml` file with pre-populated configuration information, such as the `Fleet ID` and `Fleet URL`.
184+
185+
[[kspm-setup-eks-modify-deploy]]
186+
[discrete]
187+
==== Deploy the KSPM integration to EKS clusters
188+
The *Add agent* wizard helps you deploy the KSPM integration on the Kubernetes clusters you wish to monitor. For each cluster:
189+
190+
1. Download the manifest and make any necessary revisions to its configuration to suit the needs of your environment.
191+
2. Apply the manifest using the `kubectl apply -f` command. For example: `kubectl apply -f elastic-agent-managed-kubernetes.yaml`
192+
193+
After a few minutes, a message confirming the {agent} enrollment appears, followed by a message confirming that data is incoming. You can then click *View assets* to see where the newly-collected configuration information appears throughout {kib}, including the <<findings-page,Findings page>> and the <<cloud-posture-dashboard, Cloud Posture dashboard>>.
194+
195+
196+
[discrete]
197+
[[kspm-setup-unmanaged]]
198+
=== Set up KSPM for unmanaged Kubernetes clusters
199+
200+
Follow these steps to deploy the KSPM integration to unmanaged clusters. Keep in mind credentials are NOT required for unmanaged deployments.
201+
202+
[discrete]
203+
==== Configure the KSPM integration
204+
To install the integration on unmanaged clusters:
205+
206+
1. Go to *Dashboards -> Cloud Posture*.
207+
2. Click *Add a KSPM integration*.
208+
3. Read the integration's description to understand how it works. Then, click *Add Kubernetes Security Posture Management*.
209+
4. Name your integration. Use a name that matches the purpose or team of the cluster(s) you want to monitor, for example, `IT-dev-k8s-clusters`.
210+
5. Select *Unmanaged Kubernetes* from the *Kubernetes Deployment* menu.
211+
6. If you want to monitor Kubernetes clusters that aren’t yet enrolled in {fleet}, select *New Hosts* when choosing the {agent} policy.
212+
7. Select the {agent} policy where you want to add the integration.
213+
8. Click *Save and continue*, then *Add agent to your hosts*. The *Add agent* wizard appears and provides a DaemonSet manifest `.yaml` file with pre-populated configuration information, such as the `Fleet ID` and `Fleet URL`.
214+
215+
[role="screenshot"]
216+
image::images/kspm-add-agent-wizard.png[The KSPM integration's Add agent wizard]
217+
218+
[[kspm-setup-unmanaged-modify-deploy]]
219+
[discrete]
220+
==== Deploy the KSPM integration to unmanaged clusters
221+
222+
The *Add agent* wizard helps you deploy the KSPM integration on the Kubernetes clusters you wish to monitor. To do this, for each cluster:
223+
224+
1. Download the manifest and make any necessary revisions to its configuration to suit the needs of your environment.
225+
2. Apply the manifest using the `kubectl apply -f` command. For example: `kubectl apply -f elastic-agent-managed-kubernetes.yaml`
226+
227+
After a few minutes, a message confirming the {agent} enrollment appears, followed by a message confirming that data is incoming. You can then click *View assets* to see where the newly-collected configuration information appears throughout {kib}, including the <<findings-page,Findings page>> and the <<cloud-posture-dashboard, Cloud Posture dashboard>>.

‎docs/cloud-native-security/kspm.asciidoc‎

Lines changed: 2 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,6 @@
11
[[kspm]]
22
= Kubernetes security posture management
33

4-
The Kubernetes Security Posture Management (KSPM) integration allows you to monitor how your Kubernetes clusters' configuration measures up to security benchmarks.
4+
The Kubernetes Security Posture Management (KSPM) integration allows you to identify security and compliance issues in the configuration of various Kubernetes components.
55

6-
To set up the integration, you'll need to first add it to an {agent} policy, then deploy the KSPM DaemonSet to the Kubernetes clusters you want to monitor.
7-
8-
[discrete]
9-
== Set up a KSPM integration
10-
To install the integration:
11-
12-
1. Go to *Dashboards -> Cloud Posture*.
13-
2. Click *Add a CIS integration*.
14-
3. Click *Add Kubernetes Security Posture Management*.
15-
4. Name your integration.
16-
5. Select whether to use the CIS or EKS Benchmarks — use CIS unless you're deploying on EKS.
17-
6. Select the {agent} policy where you want to add the integration.
18-
7. Click *Save and continue*, then *Add agent to your hosts*. The *Add agent* wizard appears and provides a DaemonSet manifest `.yaml` file with pre-populated configuration information, such as the `Fleet ID` and`Fleet URL`.
19-
20-
image::images/kspm-add-agent-wizard.png[The KSPM integration's Add agent wizard]
21-
22-
The *Add agent* wizard helps you deploy a DaemonSet on the Kubernetes clusters you wish to monitor. To do this, for each cluster:
23-
24-
1. Download the manifest and make any necessary revisions to its configuration to suit the needs of your environment.
25-
2. Apply the manifest using the `kubectl apply -f` command. For example: `kubectl apply -f elastic-agent-managed-kubernetes.yaml`
26-
27-
After about a minute, an “Agent enrollment confirmed” message appears, followed by “Incoming data confirmed." You can then click *View assets* to see where the newly-collected configuration information appears throughout {kib}, including the <<findings-page,Findings page>> and the <<cloud-posture-dashboard, Cloud Posture dashboard>>.
28-
29-
[[findings-page]]
30-
[discrete]
31-
== Findings page
32-
33-
image::images/findings-page.png[The Findings page]
34-
35-
The Findings page shows how the configuration of your Kubernetes clusters measures up to the standards defined on the <<benchmark-rules, CSP Benchmarks page>>.
36-
37-
Findings are organized by the resource IDs of the associated Kubernetes infrastructure and include data about the infrastructure and benchmark rules. Each finding's result (which can be `pass` or `fail`) indicates whether a particular part of your Kubernetes infrastructure meets an active CSP benchmark rule.
38-
39-
You can filter table data by entering queries into the KQL search bar.
6+
This integration is currently supported for use with unmanaged Kubernetes clusters, as well as clusters managed by Amazon EKS. To set it up, you'll need to first add it to an {fleet-guide}/agent-policy.html[{agent} policy], then deploy the KSPM DaemonSet to the Kubernetes clusters you want to monitor. This process differs slightly depending on whether you intend to monitor unmanaged clusters or EKS-managed clusters.

0 commit comments

Comments
 (0)