Add Kubernetes CIS Benchmark integration by eyalkraft · Pull Request #2930 · elastic/integrations

eyalkraft · 2022-03-30T13:29:19Z

What does this PR do?

Adds the initial version of the Kuberenetes CIS Benchmark integration.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

Notes

As described here currently the package build fails as a result of it containing transforms. This is not a problem in the integration package (there are some packages with transform already - endpoint for example).

example

taken from here

➜  cis_kubernetes_benchmark git:(master) elastic-package build


Build the package
Error: building package failed: invalid content found in built package: found 1 validation error:
   1. item [transform] is not allowed in folder [/Users/eyalkraft/Workspace/elastic/integrations/build/integrations/cis_kubernetes_benchmark/0.0.3/elasticsearch]

For the integration installation to work the Cloud Security Posture Kibana plugin should be enabled.
This is due to the fact that the tranforms expect some existing indices - these indices are created by the plugin.
Enabling the plugin is done by setting xpack.cloudSecurityPosture.enabled: true in kibana.yml. By default the plugin is disabled.
This is documented in the integration doc.

example for installation attempt when the plugin isn't enabled

Author's Checklist

[ ]

How to test this PR locally

Related issues

Closes https://github.com/elastic/security-team/issues/2772

Screenshots

* initial package info * Make kubebeat work with integration inputs * working integration v1(ILM issue exists in bit) * fixed files Co-authored-by: Aleksandr Maus <aleksandr.maus@elastic.co>

rename and fix text

set multiple to false

Add data view

update assets path

update index pattern acording to cloudbeat change

eyalkraft · 2022-03-30T14:32:23Z

The plugin is safe! I will open a PR to elastic-package.

Enable the Cloud Security Posture Kibana plugin elastic-package#767

eyalkraft · 2022-03-30T14:53:08Z

have another attempt at fixing the commits for the CLA

CLA problem solved by signing

mtojek · 2022-03-31T07:46:24Z

Based on the discussion in elastic/elastic-package#767, it looks like this is a blocker for this issue.

mtojek · 2022-04-05T15:45:07Z

 /packages/zscaler_zia @elastic/security-external-integrations
-/packages/zscaler_zpa @elastic/security-external-integrations
+/packages/zscaler_zpa @elastic/security-external-integrations
+/packages/cis_kubernetes_benchmark @elastic/cloud-posture-security


Could you please place it accordingly in the alphanum? order?

mtojek · 2022-04-05T15:45:45Z

+title: "Findings"
+type: logs
+streams:
+  - input: cloudbeat


Release version bump here: #3003

…ings

changes to score transform

Fixed all findings index pattern so it won't overlap with latest findings

mtojek

CODEOWNERS LGTM

David.Natchanny and others added 30 commits December 23, 2021 15:15

Feature/kube cis package (#1)

8ee900d

* initial package info * Make kubebeat work with integration inputs * working integration v1(ILM issue exists in bit) * fixed files Co-authored-by: Aleksandr Maus <aleksandr.maus@elastic.co>

working version of adding index template

528f290

add index tempplate per resource

2686ccd

update base fields

031e03e

working version of adding data view

f62ddf9

drop unused fields

6c5d9ad

rename and fix text

6465e56

fix deploy name

fea5f60

use elastic-package to create data-stream

54c166f

pr comments

2af5347

Description update

5ad3b5e

add group

7a8a419

.

0e9e168

Merge pull request #6 from build-security/integration-update-looks

a410e55

rename and fix text

set multiple to false

05fecb6

Merge pull request #7 from build-security/single-instance-per-policy

e17f006

set multiple to false

rename

2a01de0

Merge pull request #5 from build-security/add_data_view

912bc1c

Add data view

Merge pull request #3 from build-security/add_fields_mapping

fef48f2

update assets path

f6feb62

replace quotes

1e3e458

rebane kibana assets filename

c84fe61

Merge pull request #10 from build-security/moveAssetsToNewIntegration

9764185

update assets path

format existing assets

ec8b0fa

working version of adding vars

540092f

clean

eb23f3f

add default policy

e2525eb

update index pattern acording to cloudbeat change

b6fde4e

format

6b14e7d

Merge pull request #14 from build-security/updateDataViewIndexPattern

3d62761

update index pattern acording to cloudbeat change

retrigger checks

66ba5d8

fix changelog

00d1601

eyalkraft mentioned this pull request Mar 30, 2022

Enable the Cloud Security Posture Kibana plugin elastic/elastic-package#767

Merged

eyalkraft added 2 commits March 31, 2022 13:42

update screenshots

02b46a7

modify screenshots again

3e75705

mtojek reviewed Apr 5, 2022

View reviewed changes

eyalkraft and others added 15 commits April 6, 2022 16:28

Merge branch 'main' into initial-merge-cis-benchmark

3cd1643

changes to score transform

6ae7dfa

sort codeowners

9f662f2

remove codeowners trailing newline

ce6625c

changelog update

f5b9442

Fixed all findings index pattern so it won't overlap with latest find…

4f75c3b

…ings

Merge pull request #20 from build-security/change-score-transform

20c917f

changes to score transform

Merge branch 'master' into fix_index_pattern

f080e37

Merge pull request #21 from build-security/fix_index_pattern

ede7667

Fixed all findings index pattern so it won't overlap with latest findings

Merge branch 'elastic:main' into initial-merge-cis-benchmark

f23f7e1

update from build-security/master

285c74d

fix codeowners

5feeb48

remove newline

1a1bd8f

remove transforms

4674dd6

update owner group name

da4a3d7

eyalkraft marked this pull request as ready for review April 7, 2022 13:09

eyalkraft requested a review from a team as a code owner April 7, 2022 13:09

mtojek approved these changes Apr 11, 2022

View reviewed changes

eyalkraft merged commit ff96a82 into elastic:main Apr 11, 2022

kfirpeled deleted the initial-merge-cis-benchmark branch April 14, 2022 18:49

andrewkroh added the New Integration Issue or pull request for creating a new integration package. label Aug 13, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Kubernetes CIS Benchmark integration#2930

Add Kubernetes CIS Benchmark integration#2930
eyalkraft merged 85 commits intomainfrom
unknown repository

eyalkraft commented Mar 30, 2022 •

edited

Loading

Uh oh!

eyalkraft commented Mar 30, 2022

Uh oh!

eyalkraft commented Mar 30, 2022

Uh oh!

mtojek commented Mar 31, 2022

Uh oh!

mtojek Apr 5, 2022

Uh oh!

eyalkraft Apr 6, 2022

Uh oh!

mtojek Apr 5, 2022

Uh oh!

mtojek left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

Conversation

eyalkraft commented Mar 30, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Checklist

Notes

Author's Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

eyalkraft commented Mar 30, 2022

Uh oh!

eyalkraft commented Mar 30, 2022

Uh oh!

mtojek commented Mar 31, 2022

Uh oh!

mtojek Apr 5, 2022

Choose a reason for hiding this comment

Uh oh!

eyalkraft Apr 6, 2022

Choose a reason for hiding this comment

Uh oh!

mtojek Apr 5, 2022

Choose a reason for hiding this comment

Uh oh!

mtojek left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

eyalkraft commented Mar 30, 2022 •

edited

Loading