[Cloud Posture] Rule template schema changes - introducing metadata field

packages/cloud_security_posture/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.0.17"
+  changes:
+    - description: Refactored csp-rule-template `metadata` field to fit 8.4.0 schema
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3561
 - version: "0.0.16"
   changes:
     - description: update resource id keyword mapping

packages/cloud_security_posture/kibana/csp_rule_template/0434fc0b-4b72-5a73-8bee-8c8c40345165.json

@@ -2,30 +2,36 @@
     "id": "0434fc0b-4b72-5a73-8bee-8c8c40345165",
     "type": "csp-rule-template",
     "attributes": {
-        "id": "0434fc0b-4b72-5a73-8bee-8c8c40345165",
-        "name": "Ensure that the --profiling argument is set to false (Automated)",
-        "profile_applicability": "* Level 1 - Master Node\n",
-        "description": "Disable profiling, if not needed.\n",
-        "rationale": "Profiling allows for the identification of specific performance bottlenecks. It generates a significant amount of program data that could potentially be exploited to uncover system and program details. If you are not experiencing any bottlenecks and do not need the profiler for troubleshooting purposes, it is recommended to turn it off to reduce the potential attack surface.\n",
-        "audit": "Run the following command on the control plane node:\n```\nps -ef | grep kube-apiserver\n```\nVerify that the `--profiling` argument is set to `false`.\n",
-        "remediation": "Edit the API server pod specification file\n`/etc/kubernetes/manifests/kube-apiserver.yaml` \non the control plane node and set the below parameter.\n```\n--profiling=false\n```\n",
-        "impact": "Profiling information would not be available.\n",
-        "default_value": "By default, profiling is enabled.\n",
-        "references": "1. [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)\n2. [https://github.com/kubernetes/community/blob/master/contributors/devel/profiling.md](https://github.com/kubernetes/community/blob/master/contributors/devel/profiling.md)\n",
-        "section": "API Server",
-        "version": "1.0",
-        "tags": [
-            "CIS",
-            "Kubernetes",
-            "CIS 1.2.18",
-            "API Server"
-        ],
-        "benchmark": {
-            "name": "CIS Kubernetes V1.23",
-            "version": "v1.0.0"
-        },
         "enabled": true,
         "muted": false,
-        "rego_rule_id": "cis_1_2_18"
-    }
+        "metadata": {
+            "id": "0434fc0b-4b72-5a73-8bee-8c8c40345165",
+            "name": "Ensure that the --profiling argument is set to false (Automated)",
+            "profile_applicability": "* Level 1 - Master Node\n",
+            "description": "Disable profiling, if not needed.\n",
+            "rationale": "Profiling allows for the identification of specific performance bottlenecks. It generates a significant amount of program data that could potentially be exploited to uncover system and program details. If you are not experiencing any bottlenecks and do not need the profiler for troubleshooting purposes, it is recommended to turn it off to reduce the potential attack surface.\n",
+            "audit": "Run the following command on the control plane node:\n```\nps -ef | grep kube-apiserver\n```\nVerify that the `--profiling` argument is set to `false`.\n",
+            "remediation": "Edit the API server pod specification file\n`/etc/kubernetes/manifests/kube-apiserver.yaml` \non the control plane node and set the below parameter.\n```\n--profiling=false\n```\n",
+            "impact": "Profiling information would not be available.\n",
+            "default_value": "By default, profiling is enabled.\n",
+            "references": "1. [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)\n2. [https://github.com/kubernetes/community/blob/master/contributors/devel/profiling.md](https://github.com/kubernetes/community/blob/master/contributors/devel/profiling.md)\n",
+            "section": "API Server",
+            "version": "1.0",
+            "tags": [
+                "CIS",
+                "Kubernetes",
+                "CIS 1.2.18",
+                "API Server"
+            ],
+            "benchmark": {
+                "name": "CIS Kubernetes V1.23",
+                "version": "v1.0.0"
+            },
+            "rego_rule_id": "cis_1_2_18"
+        }
+    },
+    "migrationVersion": {
+        "csp-rule-template": "8.4.0"
+    },
+    "coreMigrationVersion": "8.4.0"
 }

packages/cloud_security_posture/kibana/csp_rule_template/058dd742-d183-57c8-9115-16ab34615037.json

@@ -2,30 +2,36 @@
     "id": "058dd742-d183-57c8-9115-16ab34615037",
     "type": "csp-rule-template",
     "attributes": {
-        "id": "058dd742-d183-57c8-9115-16ab34615037",
-        "name": "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)",
-        "profile_applicability": "* Level 1 - Master Node\n",
-        "description": "Retain the logs for at least 30 days or as appropriate.\n",
-        "rationale": "Retaining logs for at least 30 days ensures that you can go back in time and investigate or correlate any events. Set your audit log retention period to 30 days or as per your business requirements.\n",
-        "audit": "Run the following command on the control plane node:\n```\nps -ef | grep kube-apiserver\n```\nVerify that the `--audit-log-maxage` argument is set to `30` or as appropriate.\n",
-        "remediation": "Edit the API server pod specification file\n`/etc/kubernetes/manifests/kube-apiserver.yaml` \non the control plane node and set the `--audit-log-maxage` parameter to 30 or\nas an appropriate number of days:\n```\n--audit-log-maxage=30\n```\n",
-        "impact": "None\n",
-        "default_value": "By default, auditing is not enabled.\n",
-        "references": "1. [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)\n2. [https://kubernetes.io/docs/concepts/cluster-administration/audit/](https://kubernetes.io/docs/concepts/cluster-administration/audit/)\n3. [https://github.com/kubernetes/features/issues/22](https://github.com/kubernetes/features/issues/22)\n",
-        "section": "API Server",
-        "version": "1.0",
-        "tags": [
-            "CIS",
-            "Kubernetes",
-            "CIS 1.2.20",
-            "API Server"
-        ],
-        "benchmark": {
-            "name": "CIS Kubernetes V1.23",
-            "version": "v1.0.0"
-        },
         "enabled": true,
         "muted": false,
-        "rego_rule_id": "cis_1_2_20"
-    }
+        "metadata": {
+            "id": "058dd742-d183-57c8-9115-16ab34615037",
+            "name": "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)",
+            "profile_applicability": "* Level 1 - Master Node\n",
+            "description": "Retain the logs for at least 30 days or as appropriate.\n",
+            "rationale": "Retaining logs for at least 30 days ensures that you can go back in time and investigate or correlate any events. Set your audit log retention period to 30 days or as per your business requirements.\n",
+            "audit": "Run the following command on the control plane node:\n```\nps -ef | grep kube-apiserver\n```\nVerify that the `--audit-log-maxage` argument is set to `30` or as appropriate.\n",
+            "remediation": "Edit the API server pod specification file\n`/etc/kubernetes/manifests/kube-apiserver.yaml` \non the control plane node and set the `--audit-log-maxage` parameter to 30 or\nas an appropriate number of days:\n```\n--audit-log-maxage=30\n```\n",
+            "impact": "None\n",
+            "default_value": "By default, auditing is not enabled.\n",
+            "references": "1. [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)\n2. [https://kubernetes.io/docs/concepts/cluster-administration/audit/](https://kubernetes.io/docs/concepts/cluster-administration/audit/)\n3. [https://github.com/kubernetes/features/issues/22](https://github.com/kubernetes/features/issues/22)\n",
+            "section": "API Server",
+            "version": "1.0",
+            "tags": [
+                "CIS",
+                "Kubernetes",
+                "CIS 1.2.20",
+                "API Server"
+            ],
+            "benchmark": {
+                "name": "CIS Kubernetes V1.23",
+                "version": "v1.0.0"
+            },
+            "rego_rule_id": "cis_1_2_20"
+        }
+    },
+    "migrationVersion": {
+        "csp-rule-template": "8.4.0"
+    },
+    "coreMigrationVersion": "8.4.0"
 }

packages/cloud_security_posture/kibana/csp_rule_template/07361e5e-0142-57ce-8e42-d6ebd5110d2e.json

@@ -2,30 +2,36 @@
     "id": "07361e5e-0142-57ce-8e42-d6ebd5110d2e",
     "type": "csp-rule-template",
     "attributes": {
-        "id": "07361e5e-0142-57ce-8e42-d6ebd5110d2e",
-        "name": "Ensure that the --audit-log-path argument is set (Automated)",
-        "profile_applicability": "* Level 1 - Master Node\n",
-        "description": "Enable auditing on the Kubernetes API Server and set the desired audit log path.\n",
-        "rationale": "Auditing the Kubernetes API Server provides a security-relevant chronological set of records documenting the sequence of activities that have affected system by individual users, administrators or other components of the system. Even though currently, Kubernetes provides only basic audit capabilities, it should be enabled. You can enable it by setting an appropriate audit log path.\n",
-        "audit": "Run the following command on the control plane node:\n```\nps -ef | grep kube-apiserver\n```\nVerify that the `--audit-log-path` argument is set as appropriate.\n",
-        "remediation": "Edit the API server pod specification file\n`/etc/kubernetes/manifests/kube-apiserver.yaml` \non the control plane node and set the `--audit-log-path` parameter to a suitable\npath and file where you would like audit logs to be written, for example:\n```\n--audit-log-path=/var/log/apiserver/audit.log\n```\n",
-        "impact": "None\n",
-        "default_value": "By default, auditing is not enabled.\n",
-        "references": "1. [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)\n2. [https://kubernetes.io/docs/concepts/cluster-administration/audit/](https://kubernetes.io/docs/concepts/cluster-administration/audit/)\n3. [https://github.com/kubernetes/features/issues/22](https://github.com/kubernetes/features/issues/22)\n",
-        "section": "API Server",
-        "version": "1.0",
-        "tags": [
-            "CIS",
-            "Kubernetes",
-            "CIS 1.2.19",
-            "API Server"
-        ],
-        "benchmark": {
-            "name": "CIS Kubernetes V1.23",
-            "version": "v1.0.0"
-        },
         "enabled": true,
         "muted": false,
-        "rego_rule_id": "cis_1_2_19"
-    }
+        "metadata": {
+            "id": "07361e5e-0142-57ce-8e42-d6ebd5110d2e",
+            "name": "Ensure that the --audit-log-path argument is set (Automated)",
+            "profile_applicability": "* Level 1 - Master Node\n",
+            "description": "Enable auditing on the Kubernetes API Server and set the desired audit log path.\n",
+            "rationale": "Auditing the Kubernetes API Server provides a security-relevant chronological set of records documenting the sequence of activities that have affected system by individual users, administrators or other components of the system. Even though currently, Kubernetes provides only basic audit capabilities, it should be enabled. You can enable it by setting an appropriate audit log path.\n",
+            "audit": "Run the following command on the control plane node:\n```\nps -ef | grep kube-apiserver\n```\nVerify that the `--audit-log-path` argument is set as appropriate.\n",
+            "remediation": "Edit the API server pod specification file\n`/etc/kubernetes/manifests/kube-apiserver.yaml` \non the control plane node and set the `--audit-log-path` parameter to a suitable\npath and file where you would like audit logs to be written, for example:\n```\n--audit-log-path=/var/log/apiserver/audit.log\n```\n",
+            "impact": "None\n",
+            "default_value": "By default, auditing is not enabled.\n",
+            "references": "1. [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)\n2. [https://kubernetes.io/docs/concepts/cluster-administration/audit/](https://kubernetes.io/docs/concepts/cluster-administration/audit/)\n3. [https://github.com/kubernetes/features/issues/22](https://github.com/kubernetes/features/issues/22)\n",
+            "section": "API Server",
+            "version": "1.0",
+            "tags": [
+                "CIS",
+                "Kubernetes",
+                "CIS 1.2.19",
+                "API Server"
+            ],
+            "benchmark": {
+                "name": "CIS Kubernetes V1.23",
+                "version": "v1.0.0"
+            },
+            "rego_rule_id": "cis_1_2_19"
+        }
+    },
+    "migrationVersion": {
+        "csp-rule-template": "8.4.0"
+    },
+    "coreMigrationVersion": "8.4.0"
 }

packages/cloud_security_posture/kibana/csp_rule_template/0cd77c44-7420-5cac-a366-821b44bf819e.json

@@ -2,30 +2,36 @@
     "id": "0cd77c44-7420-5cac-a366-821b44bf819e",
     "type": "csp-rule-template",
     "attributes": {
-        "id": "0cd77c44-7420-5cac-a366-821b44bf819e",
-        "name": "Ensure that the admission control plugin NodeRestriction is set (Automated)",
-        "profile_applicability": "* Level 1 - Master Node\n",
-        "description": "Limit the `Node` and `Pod` objects that a kubelet could modify.\n",
-        "rationale": "Using the `NodeRestriction` plug-in ensures that the kubelet is restricted to the `Node` and Pod objects that it could modify as defined. Such kubelets will only be allowed to modify their own `Node` API object, and only modify `Pod` API objects that are bound to their node.\n",
-        "audit": "Run the following command on the control plane node:\n```\nps -ef | grep kube-apiserver\n```\nVerify that the `--enable-admission-plugins` argument is set to a value that includes\n`NodeRestriction`.\n",
-        "remediation": "Follow the Kubernetes documentation and configure `NodeRestriction` plug-in\non\nkubelets.\nThen, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` \non the control plane node and set the `--enable-admission-plugins` parameter\nto a value that includes `NodeRestriction`.\n```\n--enable-admission-plugins=...,NodeRestriction,...\n```\n",
-        "impact": "None\n",
-        "default_value": "By default, `NodeRestriction` is not set.\n",
-        "references": "1. [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)\n2. [https://kubernetes.io/docs/admin/admission-controllers/#noderestriction](https://kubernetes.io/docs/admin/admission-controllers/#noderestriction)\n3. [https://kubernetes.io/docs/admin/authorization/node/](https://kubernetes.io/docs/admin/authorization/node/)\n4. [https://acotten.com/post/kube17-security](https://acotten.com/post/kube17-security)\n",
-        "section": "API Server",
-        "version": "1.0",
-        "tags": [
-            "CIS",
-            "Kubernetes",
-            "CIS 1.2.16",
-            "API Server"
-        ],
-        "benchmark": {
-            "name": "CIS Kubernetes V1.23",
-            "version": "v1.0.0"
-        },
         "enabled": true,
         "muted": false,
-        "rego_rule_id": "cis_1_2_16"
-    }
+        "metadata": {
+            "id": "0cd77c44-7420-5cac-a366-821b44bf819e",
+            "name": "Ensure that the admission control plugin NodeRestriction is set (Automated)",
+            "profile_applicability": "* Level 1 - Master Node\n",
+            "description": "Limit the `Node` and `Pod` objects that a kubelet could modify.\n",
+            "rationale": "Using the `NodeRestriction` plug-in ensures that the kubelet is restricted to the `Node` and Pod objects that it could modify as defined. Such kubelets will only be allowed to modify their own `Node` API object, and only modify `Pod` API objects that are bound to their node.\n",
+            "audit": "Run the following command on the control plane node:\n```\nps -ef | grep kube-apiserver\n```\nVerify that the `--enable-admission-plugins` argument is set to a value that includes\n`NodeRestriction`.\n",
+            "remediation": "Follow the Kubernetes documentation and configure `NodeRestriction` plug-in\non\nkubelets.\nThen, edit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` \non the control plane node and set the `--enable-admission-plugins` parameter\nto a value that includes `NodeRestriction`.\n```\n--enable-admission-plugins=...,NodeRestriction,...\n```\n",
+            "impact": "None\n",
+            "default_value": "By default, `NodeRestriction` is not set.\n",
+            "references": "1. [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)\n2. [https://kubernetes.io/docs/admin/admission-controllers/#noderestriction](https://kubernetes.io/docs/admin/admission-controllers/#noderestriction)\n3. [https://kubernetes.io/docs/admin/authorization/node/](https://kubernetes.io/docs/admin/authorization/node/)\n4. [https://acotten.com/post/kube17-security](https://acotten.com/post/kube17-security)\n",
+            "section": "API Server",
+            "version": "1.0",
+            "tags": [
+                "CIS",
+                "Kubernetes",
+                "CIS 1.2.16",
+                "API Server"
+            ],
+            "benchmark": {
+                "name": "CIS Kubernetes V1.23",
+                "version": "v1.0.0"
+            },
+            "rego_rule_id": "cis_1_2_16"
+        }
+    },
+    "migrationVersion": {
+        "csp-rule-template": "8.4.0"
+    },
+    "coreMigrationVersion": "8.4.0"
 }