Skip to content

[Cloud Posture] add benchmark id to rule template - #3654

Merged
orouz merged 6 commits into
elastic:mainfrom
orouz:csp_benchmark_id
Jul 14, 2022
Merged

[Cloud Posture] add benchmark id to rule template#3654
orouz merged 6 commits into
elastic:mainfrom
orouz:csp_benchmark_id

Conversation

@orouz

@orouz orouz commented Jul 5, 2022 •
edited
Loading

Copy link
Copy Markdown
Contributor

What does this PR do?

this PR uses the newly introduced benchmark.id property and assigns every existing rule templates to use cis_k8s as its benchmark id.
when EKS rule templates are introduced, they should be added with their benchmark id property set to cis_eks

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

  1. use local package registry
    • setup xpack.fleet.registryUrl: 'http://localhost:8080' in kibana.dev.yml
    • pull this PR integrations PR
    • add an eks rule
      • copy-paste a cis_k8s rule
      • change its id so it's unique (replace a single char)
      • change the benchmark.id to cis_eks
    • run elastic-package build && elastic-package stack up -v -s package-registry
  2. add a CIS integration per benchmark and verify the number of rules is 92 for cis_k8s and 1 for cis_eks

example:
Screen Shot 2022-07-11 at 16 06 55
@elasticmachine

elasticmachine commented Jul 5, 2022 •
edited
Loading

Copy link
Copy Markdown

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-07-14T10:06:24.319+0000

  • Duration: 15 min 30 sec

Test stats 🧪

Test Results
Failed 0
Passed 1
Skipped 0
Total 1

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.
@orouz
orouz force-pushed the csp_benchmark_id branch from f84ddff to 9f9ee0d Compare July 5, 2022 13:57
@elasticmachine

elasticmachine commented Jul 5, 2022 •
edited
Loading

Copy link
Copy Markdown

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (0/0) 💚
Files 100.0% (0/0) 💚 3.145
Classes 100.0% (0/0) 💚 3.145
Methods 33.333% (1/3) 👎 -56.189
Lines 100.0% (0/0) 💚 8.927
Conditionals 100.0% (0/0) 💚
@orouz

orouz commented Jul 5, 2022

Copy link
Copy Markdown
Contributor Author

/test
@orouz
orouz force-pushed the csp_benchmark_id branch from 9f9ee0d to b369229 Compare July 11, 2022 12:23
@orouz
orouz force-pushed the csp_benchmark_id branch from b369229 to 4461821 Compare July 11, 2022 12:45
@orouz orouz mentioned this pull request Jul 11, 2022
Merged
1 task
orouz
orouz commented Jul 11, 2022
View reviewed changes
Comment thread packages/cloud_security_posture/data_stream/findings/manifest.yml Outdated
kfirpeled
kfirpeled suggested changes Jul 12, 2022
View reviewed changes
Comment thread packages/cloud_security_posture/changelog.yml Outdated
@orouz
orouz requested a review from kfirpeled July 12, 2022 14:05
kfirpeled
kfirpeled approved these changes Jul 12, 2022
View reviewed changes
Comment thread packages/cloud_security_posture/data_stream/findings/manifest.yml Outdated
description: Check CIS Benchmark compliance
description: |
Check CIS Benchmark compliance
###### only a single benchmark can be enabled. default is K8s CIS.

@kfirpeled kfirpeled Jul 12, 2022

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit today's markdown makes the text in capital letters, however, it can be changed at some point - consider changing it to Only a single benchmark can be enabled. Default is K8s CIS. - just to be on the safe side
Comment thread packages/cloud_security_posture/data_stream/findings/manifest.yml Outdated
description: Check CIS Amazon Benchmark compliance
description: |
Check CIS Amazon Benchmark compliance
###### only a single benchmark can be enabled. default is K8s CIS.

@kfirpeled kfirpeled Jul 12, 2022

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same
kfirpeled
kfirpeled reviewed Jul 12, 2022
View reviewed changes
Comment thread packages/cloud_security_posture/data_stream/findings/manifest.yml Outdated
description: Check CIS Benchmark compliance
description: |
Check CIS Benchmark compliance
###### only a single benchmark can be enabled. default is K8s CIS.

@kfirpeled kfirpeled Jul 12, 2022

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
###### only a single benchmark can be enabled. default is K8s CIS.
###### Only a single benchmark can be enabled. Default is K8s CIS.
Comment thread packages/cloud_security_posture/data_stream/findings/manifest.yml Outdated
description: Check CIS Amazon Benchmark compliance
description: |
Check CIS Amazon Benchmark compliance
###### only a single benchmark can be enabled. default is K8s CIS.

@kfirpeled kfirpeled Jul 12, 2022

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
###### only a single benchmark can be enabled. default is K8s CIS.
###### Only a single benchmark can be enabled. Default is K8s CIS.
@orouz

orouz commented Jul 13, 2022

Copy link
Copy Markdown
Contributor Author

/test
@oren-zohar oren-zohar mentioned this pull request Jul 13, 2022
Merged
5 tasks
@orouz

orouz commented Jul 14, 2022

Copy link
Copy Markdown
Contributor Author

/test
@oren-zohar
oren-zohar marked this pull request as ready for review July 14, 2022 09:09
@oren-zohar
oren-zohar requested a review from a team as a code owner July 14, 2022 09:09
@orouz
orouz merged commit caa1ae7 into elastic:main Jul 14, 2022
@kfirpeled kfirpeled added the Team:Cloud Security Cloud Security team [elastic/cloud-security-posture] label Jun 26, 2023
orestisfl pushed a commit to orestisfl/integrations that referenced this pull request May 15, 2026
@orouz
[Cloud Posture] add benchmark id to rule template (elastic#3654)
f309eda
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Team:Cloud Security Cloud Security team [elastic/cloud-security-posture]

3 participants

@orouz @elasticmachine @kfirpeled