You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/en/security/cloud_security_management/misconfigurations/compliance_rules.md
+1-19Lines changed: 1 addition & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -30,7 +30,7 @@ Cloud Security Misconfigurations uses the following rule types to validate the c
30
30
-**Linux workloads**, using CIS host benchmarks for Linux distributions including Ubuntu, Red Hat, Amazon Linux, and AlmaLinux.
31
31
32
32
Cloud Security Misconfigurations supports a subset of the Linux distributions that the Agent supports. For more information, see [Supported Platforms][6].
33
-
33
+
34
34
{{% cloud-sec-cloud-infra %}}
35
35
36
36
## Explore default compliance rules
@@ -57,24 +57,6 @@ After you customize a rule, click **Update Rule** at the bottom of the page to a
57
57
58
58
{{< img src="security/cspm/frameworks_and_benchmarks/never-trigger-misconfiguration.png" alt="Customize how your environment is scanned by selecting tags to include or exclude from a rule's scope" >}}
59
59
60
-
## Set notification targets for compliance rules
61
-
62
-
You can send real-time notifications when a new misconfiguration is detected in your environment by adding notification targets. The available notification options are:
63
-
64
-
-[Slack][14]
65
-
-[Jira][15]
66
-
-[PagerDuty][16]
67
-
-[ServiceNow][17]
68
-
-[Microsoft Teams][18]
69
-
-[Webhooks][19]
70
-
- Email
71
-
72
-
On the [Rules][13] page, select a rule to open its details page. In the **Set severity and notifications** section, configure zero or more notification targets for each rule case. You cannot edit the preset severity. See [Notifications][7] for detailed instructions on configuring notifications for compliance rules.
73
-
74
-
Alternatively, create [notification rules][21] that span across multiple compliance rules based on parameters such as severities, rule types, rule tags, signal attributes, and signal tags. This allows you to avoid having to manually edit notification preferences for individual compliance rules.
75
-
76
-
{{< img src="security/cspm/frameworks_and_benchmarks/notification-2.png" alt="The Set severity and notifications section of the rule details page" >}}
77
-
78
60
## Create custom rules
79
61
80
62
You can create custom rules to extend the rules being applied to your environment to evaluate your security posture. You can also clone the default detection rules and edit the copies (Google Cloud only). See [Custom Rules][20] for more information.
Copy file name to clipboardExpand all lines: content/en/security/cloud_security_management/misconfigurations/custom_rules.md
+6-10Lines changed: 6 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,7 +23,7 @@ cascade:
23
23
## Overview
24
24
25
25
To extend the rules being applied to your environment to evaluate your security posture, you can clone compliance rules and edit the copies, and you can create your own rules from scratch.
26
-
To view the list of the available resource types for your custom rules, see [Cloud Resources Schema][8].
26
+
To view the list of the available resource types for your custom rules, see [Cloud Resources Schema][6].
27
27
28
28
## Cloning rules
29
29
@@ -50,10 +50,8 @@ To create a rule from scratch:
50
50
6. Exclude benign activity by specifying queries to include or remove certain resources from misconfigurations.
51
51
7. Validate the logic of your rule by selecting resources and clicking **Test Rule**. See which resources passed and failed, along with corresponding resource tags.
52
52
8. Specify a severity (`Critical`, `High`, `Medium`, `Low`, or `Info`) for the rule.
53
-
9. Select a facet (for example, for each resource type or for each account ID), and [specify a notification target][5] to signal.
54
-
10. In **Say what's happening**, write a description for the notification, using notification options to make it useful. Read [Notifications][6] for details.
55
-
11. Specify tags to apply to the result misconfigurations. Read [Tagging misconfigurations](#tagging-misconfigurations) for more information.
56
-
12. Click **Save Rule**.
53
+
9. Specify tags to apply to the result misconfigurations. Read [Tagging misconfigurations](#tagging-misconfigurations) for more information.
|`scored`|`true`, `false`| Indicates whether to include the rule when calculating organization's overall posture score. Automatically added to cloned rules. |
69
-
|`security`|`compliance`| Categorizes misconfigurations on the [Security Signals page][7]. Can't be removed. |
67
+
|`security`|`compliance`| Categorizes misconfigurations on the [Security Signals page][5]. Can't be removed. |
70
68
|`requirement`| String | Not allowed for custom rules. Indicates a requirement related to a compliance framework. Don't add this to rules not part of a compliance framework. |
71
69
|`cloud_provider`|`aws`, `gcp`, `azure`| Cannot be removed. Is set automatically based on resource type. |
72
70
|`control`| String | Not allowed for custom rules. Indicates a control related to a compliance framework. Don't add this to rules not part of a compliance framework. |
@@ -81,7 +79,5 @@ You can assign almost any key-value as a tag. The following table shows tags tha
0 commit comments