-
Notifications
You must be signed in to change notification settings - Fork 191
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update supported k8s version for EKS (#4915)
* update supported k8s version for eks * applies update in other location --------- Co-authored-by: Benjamin Ironside Goldstein <[email protected]> (cherry picked from commit 55e1037) # Conflicts: # docs/cloud-native-security/cspm-faq.asciidoc # docs/cloud-native-security/kspm-faq.asciidoc
- Loading branch information
1 parent
ccbb376
commit 0d06809
Showing
2 changed files
with
87 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,80 @@ | ||
[[cspm-security-posture-faq]] | ||
= Frequently asked questions (FAQ) | ||
|
||
[discrete] | ||
== CSPM FAQ | ||
Frequently asked questions about the Cloud Security Posture Management (CSPM) integration and features. | ||
|
||
*How often is my cloud security posture evaluated?* | ||
|
||
Cloud accounts are evaluated when you first deploy the CSPM integration and every 24 hours afterward. | ||
|
||
*Can I onboard multiple accounts at one time?* | ||
|
||
Yes. Follow the onboarding instructions in the getting started guides for AWS, GCP, or Azure. | ||
|
||
*When do newly enrolled cloud accounts appear on the dashboard?* | ||
|
||
After you deploy the CSPM integration, it can take up to 10 minutes for resource fetching, evaluation, and data processing before a newly enrolled account appears on the Cloud Security Posture dashboard. | ||
|
||
*When do unenrolled cloud accounts disappear from the dashboard?* | ||
|
||
Newly unenrolled cloud accounts can take a maximum of 24 hours to disappear from the Cloud Security Posture dashboard. | ||
|
||
|
||
[discrete] | ||
== KSPM FAQ | ||
Frequently asked questions about the Kubernetes Security Posture Management (KSPM) integration and features. | ||
|
||
*What versions of Kubernetes are supported?* | ||
|
||
For self-managed/vanilla and EKS clusters, Kubernetes version 1.23 is supported. | ||
|
||
*Do benchmark rules support multiple Kubernetes deployment types?* | ||
Yes. There are different sets of benchmark rules for self-managed and third party-managed deployments. Refer to <<get-started-with-kspm,Get started with KSPM>> for more information about setting up each deployment type. | ||
|
||
*Can I evaluate the security posture of my Amazon EKS clusters?* | ||
Yes. KSPM currently supports the security posture evaluation of Amazon EKS and unmanaged Kubernetes clusters. | ||
|
||
*How often is my cluster’s security posture evaluated?* | ||
Clusters are evaluated when you deploy a KSPM integration, and every four hours after that. | ||
|
||
*When do newly-enrolled clusters appear on the dashboard?* | ||
It can take up to 10 minutes for deployment, resource fetching, evaluation, and data processing to complete before a newly-enrolled cluster appears on the dashboard. | ||
|
||
*When do unenrolled clusters disappear from the dashboard?* | ||
A cluster will disappear as soon as the KSPM integration fetches data while that cluster is not enrolled. The fetch process repeats every four hours, which means a newly unenrolled cluster can take a maximum of four hours to disappear from the dashboard. | ||
|
||
[discrete] | ||
== Findings page | ||
|
||
*Are all the findings page current?* | ||
Yes. Only the most recent findings appear on the Findings page. | ||
|
||
*Can I build custom visualizations and dashboards that incorporate findings data?* | ||
Yes. You can use {kib}'s custom visualization capabilities with findings data. To learn more, refer to {kibana-ref}/dashboard.html[Dashboards and visualizations]. | ||
|
||
*Where is Findings data saved?* | ||
You can access findings data using the following index patterns: | ||
|
||
* **Current findings:** `logs-cloud_security_posture.findings_latest-*` | ||
* **Historical findings:** `logs-cloud_security_posture.findings-*` | ||
|
||
|
||
[discrete] | ||
== Benchmark rules | ||
|
||
*How often are my resources evaluated against benchmark rules?* | ||
Resources are fetched and evaluated against benchmark rules when a security posture management integration is deployed. After that, the CSPM integration evaluates every 24 hours, and the KSPM integration evaluates every four hours. | ||
|
||
*Can I configure an integration's fetch cycle?* | ||
No, the fetch cycle's timing is not configurable. | ||
|
||
*Can I contribute to the CSP ruleset?* | ||
You can't directly edit benchmark rules. The rules are defined https://github.com/elastic/csp-security-policies[in this repository], where you can raise issues with certain rules. They are written in https://www.openpolicyagent.org/docs/latest/policy-language/[Rego]. | ||
|
||
*How can I tell which specific version of the CIS benchmarks is in use?* | ||
Refer to the `rule.benchmark.name` and `rule.benchmark.version` fields for documents in these datastreams: | ||
|
||
* `logs-cloud_security_posture.findings-default` | ||
* `logs-cloud_security_posture.findings_latest-default` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters