Skip to content

Commit 00285f9

Browse files
kfirpeledkfirpeled
authored
[Cloud Posture] Introducing cspm (elastic#4752)
1 parent c4b024d commit 00285f9

File tree

6 files changed

+207
-24
lines changed

6 files changed

+207
-24
lines changed

‎packages/cloud_security_posture/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.1.0"
3+
changes:
4+
- description: Introduce CSPM
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/4752
27
- version: "1.0.8"
38
changes:
49
- description: Update screenshots and icon

‎packages/cloud_security_posture/data_stream/findings/agent/stream/aws.yml.hbs‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
fetchers:
2+
{{!-- @elastic/cloudbeat continue work from here --}}
3+
- name: TBD
4+
processors:
5+
- add_cluster_id: ~
6+
7+
config:
8+
v1:
9+
posture: {{posture}}
10+
deployment: {{deployment}}
11+
benchmark: cis_aws
12+
aws:
13+
credentials:
14+
{{#if access_key_id}}
15+
access_key_id: {{access_key_id}}
16+
{{/if}}
17+
{{#if secret_access_key}}
18+
secret_access_key: {{secret_access_key}}
19+
{{/if}}
20+
{{#if session_token}}
21+
session_token: {{session_token}}
22+
{{/if}}
23+
{{#if shared_credential_file}}
24+
shared_credential_file: {{shared_credential_file}}
25+
{{/if}}
26+
{{#if credential_profile_name}}
27+
credential_profile_name: {{credential_profile_name}}
28+
{{/if}}
29+
{{#if role_arn}}
30+
role_arn: {{role_arn}}
31+
{{/if}}
32+
type: {{aws.credentials.type}}

‎packages/cloud_security_posture/data_stream/findings/agent/stream/eks.yml.hbs‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,31 @@
1-
name: Findings
2-
# Defines how often an event is sent to the output
1+
config:
2+
v1:
3+
posture: {{posture}}
4+
deployment: {{deployment}}
5+
benchmark: cis_eks
6+
aws:
7+
credentials:
8+
{{#if access_key_id}}
9+
access_key_id: {{access_key_id}}
10+
{{/if}}
11+
{{#if secret_access_key}}
12+
secret_access_key: {{secret_access_key}}
13+
{{/if}}
14+
{{#if session_token}}
15+
session_token: {{session_token}}
16+
{{/if}}
17+
{{#if shared_credential_file}}
18+
shared_credential_file: {{shared_credential_file}}
19+
{{/if}}
20+
{{#if credential_profile_name}}
21+
credential_profile_name: {{credential_profile_name}}
22+
{{/if}}
23+
{{#if role_arn}}
24+
role_arn: {{role_arn}}
25+
{{/if}}
26+
type: {{aws.credentials.type}}
27+
28+
329
fetchers:
430
- name: kube-api
531
- name: process
@@ -19,6 +45,8 @@ processors:
1945
- add_cluster_id: ~
2046

2147

48+
{{!-- BACKWARD COMPATIBILITY cloudbeat 8.5 & 8.6 --}}
49+
2250
runtime_cfg:
2351
activated_rules:
2452
cis_eks:

‎packages/cloud_security_posture/data_stream/findings/agent/stream/vanilla.yml.hbs‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
1-
name: Findings
2-
# Defines how often an event is sent to the output
1+
config:
2+
v1:
3+
posture: {{posture}}
4+
deployment: {{deployment}}
5+
benchmark: cis_k8s
6+
37
fetchers:
48
- name: kube-api
59
- name: process
@@ -31,6 +35,8 @@ fetchers:
3135
processors:
3236
- add_cluster_id: ~
3337

38+
{{!-- BACKWARD COMPATIBILITY cloudbeat 8.5 & 8.6 --}}
39+
3440
runtime_cfg:
3541
activated_rules:
3642
cis_k8s:

‎packages/cloud_security_posture/data_stream/findings/manifest.yml‎

Lines changed: 64 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,13 @@ elasticsearch:
88
dynamic: false
99
streams:
1010
- input: cloudbeat/cis_k8s
11-
title: K8s CIS Compliance
11+
title: CIS Kubernetes Benchmark
12+
description: CIS Benchmark for Kubernetes
1213
template_path: vanilla.yml.hbs
13-
description: |
14-
Check CIS Benchmark compliance
15-
###### Only a single benchmark can be enabled. Default is K8s CIS.
1614
- input: cloudbeat/cis_eks
17-
enabled: false
15+
title: Amazon EKS Benchmark
16+
description: CIS Benchmark for Amazon Elastic Kubernetes Service (EKS)
1817
template_path: eks.yml.hbs
19-
title: CIS Amazon EKS Compliance
20-
description: |
21-
Check CIS Amazon Benchmark compliance
22-
###### Only a single benchmark can be enabled. Default is K8s CIS.
2318
vars:
2419
- name: access_key_id
2520
type: text
@@ -58,4 +53,63 @@ streams:
5853
multi: false
5954
required: false
6055
show_user: false
61-
56+
- name: aws.credentials.type
57+
type: text
58+
title: Credential type
59+
multi: false
60+
required: false
61+
show_user: false
62+
- input: cloudbeat/cis_aws
63+
title: CIS AWS Benchmark
64+
description: CIS Benchmark for Amazon Web Services Foundations
65+
template_path: aws.yml.hbs
66+
vars:
67+
- name: access_key_id
68+
type: text
69+
title: Access Key ID
70+
multi: false
71+
required: false
72+
show_user: true
73+
- name: secret_access_key
74+
type: text
75+
title: Secret Access Key
76+
multi: false
77+
required: false
78+
show_user: true
79+
- name: session_token
80+
type: text
81+
title: Session Token
82+
multi: false
83+
required: false
84+
show_user: true
85+
- name: shared_credential_file
86+
type: text
87+
title: Shared Credential File
88+
multi: false
89+
required: false
90+
show_user: false
91+
description: Directory of the shared credentials file
92+
- name: credential_profile_name
93+
type: text
94+
title: Credential Profile Name
95+
multi: false
96+
required: false
97+
show_user: false
98+
- name: role_arn
99+
type: text
100+
title: ARN Role
101+
multi: false
102+
required: false
103+
show_user: false
104+
- name: aws.credentials.type
105+
type: text
106+
title: Credential type
107+
multi: false
108+
required: false
109+
show_user: false
110+
- input: cloudbeat/cis_gcp
111+
title: CIS GCP Benchmark
112+
description: CIS Benchmark for Google Cloud Platform Foundation
113+
- input: cloudbeat/cis_azure
114+
title: CIS Azure Benchmark
115+
description: CIS Benchmark for Microsoft Azure Foundations

‎packages/cloud_security_posture/manifest.yml‎

Lines changed: 68 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,21 @@
11
format_version: 1.0.0
22
name: cloud_security_posture
3-
title: "Kubernetes Security Posture Management (KSPM)"
4-
version: 1.0.8
3+
title: "Security Posture Management (CSPM/KSPM)"
4+
version: 1.1.0
55
release: ga
66
license: basic
7-
description: "Check Kubernetes cluster compliance with the Kubernetes CIS benchmark."
7+
description: "DO NOT USE MAIN TILE (WIP)"
88
type: integration
99
categories:
1010
- containers
1111
- kubernetes
1212
- security
13+
- cloud
14+
- aws
15+
- azure
16+
- google_cloud
1317
conditions:
14-
kibana.version: "^8.6.0"
18+
kibana.version: "^8.7.0"
1519
screenshots:
1620
- src: /img/dashboard.png
1721
title: Dashboard page
@@ -38,17 +42,71 @@ icons:
3842
title: CIS Kubernetes Benchmark logo
3943
size: 32x32
4044
type: image/svg+xml
45+
vars:
46+
- name: posture
47+
type: text
48+
title: Posture type
49+
multi: false
50+
required: true
51+
show_user: false
52+
description: Chosen posture type (cspm/kspm)
53+
- name: deployment
54+
type: text
55+
title: Deployment type
56+
multi: false
57+
required: true
58+
show_user: false
59+
description: Chosen deployment type (aws/gcp/azure/eks/k8s)
4160
policy_templates:
4261
- name: kspm
43-
title: Kubernetes Security Posture Management
44-
description: Check Kubernetes cluster compliance with the Kubernetes CIS benchmark.
62+
title: KSPM
63+
description: Measure Kubernetes compliance with hardening guidelines
4564
multiple: false
65+
categories:
66+
- containers
67+
- kubernetes
68+
- security
69+
icons:
70+
- src: /img/cis-kubernetes-benchmark-logo.svg
71+
title: CIS Kubernetes Benchmark logo
72+
size: 32x32
73+
type: image/svg+xml
74+
screenshots:
75+
- src: /img/dashboard.png
76+
title: Dashboard page
77+
size: 1293x718
78+
type: image/png
79+
data_streams:
80+
- findings
4681
inputs:
4782
- type: cloudbeat/cis_k8s
48-
title: Enable CIS Kubernetes Benchmark
49-
description: Collecting findings
83+
title: CIS Kubernetes Benchmark
84+
description: CIS Benchmark for Kubernetes
5085
- type: cloudbeat/cis_eks
51-
title: Enable Amazon EKS Benchmark
52-
description: Collecting findings
86+
title: Amazon EKS Benchmark
87+
description: CIS Benchmark for Amazon Elastic Kubernetes Service (EKS)
88+
- name: cspm
89+
title: CSPM
90+
description: Measure cloud resource compliance with relevant hardening guidelines
91+
categories:
92+
- containers
93+
- security
94+
- cloud
95+
- aws
96+
- azure
97+
- google_cloud
98+
multiple: false
99+
data_streams:
100+
- findings
101+
inputs:
102+
- type: cloudbeat/cis_aws
103+
title: Amazon Web Services
104+
description: CIS Benchmark for Amazon Web Services Foundations
105+
- type: cloudbeat/cis_gcp
106+
title: GCP
107+
description: CIS Benchmark for Google Cloud Platform Foundation
108+
- type: cloudbeat/cis_azure
109+
title: Azure
110+
description: CIS Benchmark for Microsoft Azure Foundations
53111
owner:
54112
github: elastic/cloud-security-posture

0 commit comments

Comments
 (0)