IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Findings page Cloud Posture dashboard »
Elastic Docs ›Elastic Security Solution [8.6] ›Cloud native security ›Kubernetes security posture management

Benchmark rules

edit

Benchmark rules

edit

The Benchmark Integrations page lets you view the cloud security posture (CSP) benchmark rules for the Kubernetes security posture management (KSPM) integration.

Benchmark rules are used by the KSPM integration to identify configuration risks in Kubernetes. Benchmark rules are based on the Center for Internet Security’s (CIS) secure configuration benchmarks for Kubernetes.

Each benchmark rule checks to see if a specific Kubernetes resource is configured according to a CIS Benchmark. The names of rules describe what they check, for example:

  • Ensure Kubernetes Secrets are encrypted using Customer Master Keys (CMKs) managed in AWS KMS
  • Ensure the default namespace is not in use

When benchmark rules are evaluated, the resulting findings data appears on the Cloud Posture dashboard.

To find the Benchmark Integrations page, go to Manage → CSP Benchmarks. From there, you can view the benchmark rules associated with an existing integration by clicking the integration name.

Benchmark rules page

You can then click on a benchmark rule’s name to see details, including information about how to remediate failures and related links.

Benchmark rules are not editable.

How benchmark rules work

edit
  1. When a KSPM integration is deployed, and every four hours after that, Elastic Agent fetches relevant Kubernetes resources.
  2. After Kubernetes resources are fetched, they are evaluated against all applicable benchmark rules.
  3. Finding values of pass or fail indicate whether the standards defined by benchmark rules were met.
« Findings page Cloud Posture dashboard »