- Elastic Cloud Serverless
- Elasticsearch
- Elastic Observability
- Get started
- Observability overview
- Elastic Observability Serverless billing dimensions
- Create an Observability project
- Quickstart: Monitor hosts with Elastic Agent
- Quickstart: Monitor your Kubernetes cluster with Elastic Agent
- Quickstart: Monitor hosts with OpenTelemetry
- Quickstart: Unified Kubernetes Observability with Elastic Distributions of OpenTelemetry (EDOT)
- Quickstart: Collect data with AWS Firehose
- Get started with dashboards
- Applications and services
- Application performance monitoring (APM)
- Get started with traces and APM
- Learn about data types
- Collect application data
- View and analyze data
- Act on data
- Use APM securely
- Reduce storage
- Managed intake service event API
- Troubleshooting
- Synthetic monitoring
- Get started
- Scripting browser monitors
- Configure lightweight monitors
- Manage monitors
- Work with params and secrets
- Analyze monitor data
- Monitor resources on private networks
- Use the CLI
- Configure a Synthetics project
- Multifactor Authentication for browser monitors
- Configure Synthetics settings
- Grant users access to secured resources
- Manage data retention
- Scale and architect a deployment
- Synthetics Encryption and Security
- Troubleshooting
- Application performance monitoring (APM)
- Infrastructure and hosts
- Logs
- Inventory
- Incident management
- Data set quality
- Observability AI Assistant
- Machine learning
- Reference
- Get started
- Elastic Security
- Elastic Security overview
- Security billing dimensions
- Create a Security project
- Elastic Security requirements
- Elastic Security UI
- AI for Security
- Ingest data
- Configure endpoint protection with Elastic Defend
- Manage Elastic Defend
- Endpoints
- Policies
- Trusted applications
- Event filters
- Host isolation exceptions
- Blocklist
- Optimize Elastic Defend
- Event capture and Elastic Defend
- Endpoint protection rules
- Identify antivirus software on your hosts
- Allowlist Elastic Endpoint in third-party antivirus apps
- Elastic Endpoint self-protection features
- Elastic Endpoint command reference
- Endpoint response actions
- Cloud Security
- Explore your data
- Dashboards
- Detection engine overview
- Rules
- Alerts
- Advanced Entity Analytics
- Investigation tools
- Asset management
- Manage settings
- Troubleshooting
- Manage your project
- Changelog
Frequently asked questions (FAQ)
editFrequently asked questions (FAQ)
editCSPM FAQ
editFrequently asked questions about the Cloud Security Posture Management (CSPM) integration and features.
How often is my cloud security posture evaluated?
Cloud accounts are evaluated when you first deploy the CSPM integration and every 24 hours afterward.
Can I onboard multiple accounts at one time?
Yes. Follow the onboarding instructions in the getting started guides for AWS, GCP, or Azure.
When do newly enrolled cloud accounts appear on the dashboard?
After you deploy the CSPM integration, it can take up to 10 minutes for resource fetching, evaluation, and data processing before a newly enrolled account appears on the Cloud Security Posture dashboard.
When do unenrolled cloud accounts disappear from the dashboard?
Newly unenrolled cloud accounts can take a maximum of 24 hours to disappear from the Cloud Security Posture dashboard.
KSPM FAQ
editFrequently asked questions about the Kubernetes Security Posture Management (KSPM) integration and features.
What versions of Kubernetes are supported?
For self-managed/vanilla clusters, Kubernetes version 1.23 is supported.
For EKS clusters, all Kubernetes versions available at the time of cluster deployment are supported.
Do benchmark rules support multiple Kubernetes deployment types? Yes. There are different sets of benchmark rules for self-managed and third party-managed deployments. Refer to Get started with KSPM for more information about setting up each deployment type.
Can I evaluate the security posture of my Amazon EKS clusters? Yes. KSPM currently supports the security posture evaluation of Amazon EKS and unmanaged Kubernetes clusters.
How often is my cluster’s security posture evaluated? Clusters are evaluated when you deploy a KSPM integration, and every four hours after that.
When do newly-enrolled clusters appear on the dashboard? It can take up to 10 minutes for deployment, resource fetching, evaluation, and data processing to complete before a newly-enrolled cluster appears on the dashboard.
When do unenrolled clusters disappear from the dashboard? A cluster will disappear as soon as the KSPM integration fetches data while that cluster is not enrolled. The fetch process repeats every four hours, which means a newly unenrolled cluster can take a maximum of four hours to disappear from the dashboard.
Findings page
editAre all the findings page current? Yes. Only the most recent findings appear on the Findings page.
Can I build custom visualizations and dashboards that incorporate findings data? Yes, you can use custom visualization capabilities with findings data. To learn more, refer to Dashboards and visualizations.
Where is Findings data saved? You can access findings data using the following index patterns:
-
Current findings:
logs-cloud_security_posture.findings_latest-*
-
Historical findings:
logs-cloud_security_posture.findings-*
Benchmark rules
editHow often are my resources evaluated against benchmark rules? Resources are fetched and evaluated against benchmark rules when a security posture management integration is deployed. After that, the CSPM integration evaluates every 24 hours, and the KSPM integration evaluates every four hours.
Can I configure an integration’s fetch cycle? No, the four-hour fetch cycle is not configurable.
Can I contribute to the CSP ruleset? You can’t directly edit benchmark rules. The rules are defined in this repository, where you can raise issues with certain rules. They are written in Rego.
How can I tell which specific version of the CIS benchmarks is in use?
Refer to the rule.benchmark.name
and rule.benchmark.version
fields for documents in these datastreams:
-
logs-cloud_security_posture.findings-default
-
logs-cloud_security_posture.findings_latest-default
On this page