[Cloud Posture] EKS rule templates by oren-zohar · Pull Request #3701 · elastic/integrations

oren-zohar · 2022-07-13T14:18:44Z

What does this PR do?

Adding EKS benchmark rule templates

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
~~I have verified that all data streams collect metrics or logs.~~
I have added an entry to my package's changelog.yml file.
~~I have verified that Kibana version constraints are current according to guidelines.~~

Author's Checklist

Waiting for [Cloud Posture] add benchmark id to rule template #3654

Related issues

Closes: https://github.com/elastic/security-team/issues/4129

elasticmachine · 2022-07-13T14:29:53Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2022-07-14T15:14:20.956+0000
Duration: 16 min 3 sec

Test stats 🧪

Test	Results
Failed	0
Passed	1
Skipped	0
Total	1

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

oren-zohar · 2022-07-14T09:08:21Z

/test

kfirpeled · 2022-07-14T10:32:10Z

packages/cloud_security_posture/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.0.20"


nit we haven't promoted version 0.0.19 consider added the changes to that version backlog

see example here

@orouz's PR will add it, as seen in the description, I'm waiting for it to be merged

kfirpeled · 2022-07-14T10:32:29Z

...es/cloud_security_posture/kibana/csp_rule_template/0434fc0b-4b72-5a73-8bee-8c8c40345165.json

+        "API Server"
+      ],
+      "benchmark": {
+        "name": "CIS Kubernetes V1.23",


missing benchmark id "cis_k8s" - maybe you are missing a merge from main?

@orouz PR will add it

kfirpeled · 2022-07-14T10:33:05Z

packages/cloud_security_posture/manifest.yml

 name: cloud_security_posture
 title: "CIS Kubernetes Benchmark"
-version: 0.0.18
+version: 0.0.20


consider using version 0.0.19 instead

@orouz PR uses it already

# Conflicts: # packages/cloud_security_posture/changelog.yml # packages/cloud_security_posture/manifest.yml

elasticmachine · 2022-07-14T11:02:29Z

🌐 Coverage report

Name	Metrics % (`covered/total`)	Diff
Packages	100.0% (`0/0`)	💚
Files	100.0% (`0/0`)	💚 3.049
Classes	100.0% (`0/0`)	💚 3.049
Methods	33.333% (`1/3`)	👎 -55.875
Lines	100.0% (`0/0`)	💚 9.794
Conditionals	100.0% (`0/0`)	💚

# Conflicts: # packages/cloud_security_posture/changelog.yml

kfirpeled

missing version field

kfirpeled · 2022-07-14T11:46:31Z

...es/cloud_security_posture/kibana/csp_rule_template/8c4d1ae0-5f42-5ad0-a95d-27824a774951.json

+            "impact": "Removal of the read-only port will require that any service which made use of it will need to be re-configured to use the main Kubelet API.\n",
+            "default_value": "See the Amazon EKS documentation for the default value.\n",
+            "references": "1. https://kubernetes.io/docs/admin/kubelet/\n",
+            "section": "Kubelet",


missing version

kfirpeled · 2022-07-14T11:46:41Z

...es/cloud_security_posture/kibana/csp_rule_template/98524674-3de3-5424-9afa-ca763edca62a.json

+            "default_value": "See the Amazon EKS documentation for the default value.\n",
+            "references": "1. https://kubernetes.io/docs/admin/kubelet/\n2. https://github.com/kubernetes/kubernetes/issues/22063\n3. https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/\n",
+            "section": "Kubelet",
+            "tags": [


missing version

kfirpeled · 2022-07-14T11:46:53Z

...es/cloud_security_posture/kibana/csp_rule_template/c6bcde81-4ca4-5f6f-9ef0-1116b4a02f4c.json

+            "impact": "None\n",
+            "default_value": "See the Amazon EKS documentation for the default value.\n",
+            "references": "1. https://github.com/kubernetes/kubernetes/pull/45059\n2. https://kubernetes.io/docs/admin/kubelet-tls-bootstrapping/#kubelet-configuration\n",
+            "section": "Kubelet",


missing version

kfirpeled · 2022-07-14T11:47:03Z

...es/cloud_security_posture/kibana/csp_rule_template/d4eef2c6-599a-57d1-99dd-490d3745161d.json

+            "default_value": "See the Amazon EKS documentation for the default value.\n",
+            "references": "1. https://kubernetes.io/docs/admin/kubelet/ 2. https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/apis/kubeletconfig/v1beta1/types.go 3. https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/\n",
+            "section": "Kubelet",
+            "tags": [


missing version

kfirpeled · 2022-07-14T11:47:15Z

...es/cloud_security_posture/kibana/csp_rule_template/e9322670-79b9-5177-9fc0-388712f1df07.json

+            "default_value": "See the EKS documentation for the default value.\n",
+            "references": "1. https://kubernetes.io/docs/admin/kubelet/\n2. https://github.com/kubernetes/kubernetes/pull/18552\n",
+            "section": "Kubelet",
+            "tags": [


missing version

kfirpeled · 2022-07-14T11:47:21Z

...es/cloud_security_posture/kibana/csp_rule_template/efb2ffa2-28a9-558e-aba3-f58243cb3bbb.json

+            "default_value": "See the Amazon EKS documentation for the default value.\n",
+            "references": "1. https://github.com/kubernetes/kubernetes/pull/41912\n2. https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#kubelet-configuration\n3. https://kubernetes.io/docs/imported/release/notes/\n4. https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/\n5. https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/\n",
+            "section": "Kubelet",
+            "tags": [


missing version

…-rule-templates # Conflicts: # packages/cloud_security_posture/changelog.yml

kfirpeled

works for me locally
however we still have the same formatting issues like we had before
https://github.com/elastic/security-team/issues/3672

oren-zohar added 2 commits July 13, 2022 16:53

eks rules dump

3f8ba8f

changelog + benchmark_id

68e429c

oren-zohar added the enhancement New feature or request label Jul 13, 2022

changelog update

cb95626

reformat all json objects

cf77805

oren-zohar marked this pull request as ready for review July 14, 2022 10:27

oren-zohar requested a review from a team as a code owner July 14, 2022 10:27

kfirpeled reviewed Jul 14, 2022

View reviewed changes

oren-zohar added 2 commits July 14, 2022 13:41

reformat all json objects

ab481ac

Merge remote-tracking branch 'upstream/main' into eks-rule-templates

53c3f67

# Conflicts: # packages/cloud_security_posture/changelog.yml # packages/cloud_security_posture/manifest.yml

oren-zohar and others added 4 commits July 14, 2022 14:05

0.0.20 -> 0.0.19

8f53c7d

0.0.20 -> 0.0.19

eb951d6

Merge branch 'main' into eks-rule-templates

083ae16

Merge remote-tracking branch 'upstream/main' into eks-rule-templates

097134f

# Conflicts: # packages/cloud_security_posture/changelog.yml

kfirpeled reviewed Jul 14, 2022

View reviewed changes

oren-zohar added 2 commits July 14, 2022 18:13

version

ffcfd0e

Merge remote-tracking branch 'oren-zohar/eks-rule-templates' into eks…

dbbccbd

…-rule-templates # Conflicts: # packages/cloud_security_posture/changelog.yml

oren-zohar requested a review from kfirpeled July 14, 2022 15:36

kfirpeled approved these changes Jul 14, 2022

View reviewed changes

kfirpeled merged commit e4ddfbe into elastic:main Jul 14, 2022

oren-zohar deleted the eks-rule-templates branch July 18, 2022 13:33

kfirpeled added the Team:Cloud Security Cloud Security team [elastic/cloud-security-posture] label Jun 26, 2023

		@@ -1,4 +1,9 @@
		# newer versions go on top
		- version: "0.0.20"

Conversation

oren-zohar commented Jul 13, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Checklist

Author's Checklist

Related issues

Uh oh!

elasticmachine commented Jul 13, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💚 Build Succeeded

Build stats

Test stats 🧪

🤖 GitHub comments

Uh oh!

oren-zohar commented Jul 14, 2022

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Jul 14, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🌐 Coverage report

Uh oh!

kfirpeled left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kfirpeled left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

oren-zohar commented Jul 13, 2022 •

edited

Loading

elasticmachine commented Jul 13, 2022 •

edited

Loading

elasticmachine commented Jul 14, 2022 •

edited

Loading