Menú
De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.
Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ocp-v190-3-2-1El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Basado en la clasificación ocupacional SOC
Mostrando SKILL.md
| name | cis-ocp-v190-3.2.1 |
| description | Ensure that a minimal audit policy is created (Manual) |
| category | cis-openshift |
| version | 1.9.0 |
| author | cyberstrike-official |
| tags | ["cis","openshift","kubernetes","redhat","logging","audit-policy","api-server","audit-logging"] |
| cis_id | 3.2.1 |
| cis_benchmark | CIS Red Hat OpenShift Container Platform Benchmark v1.9.0 |
| tech_stack |
| ["kubernetes","openshift","redhat"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Kubernetes can audit the details of requests made to the API server.
Logging is an important detective control for all systems, to detect potential unauthorized access.
Audit logs will be created on the master nodes, which will consume disk space. Care should be taken to avoid generating too large volumes of log information as this could impact the available of the cluster nodes.
In OpenShift, auditing of the API Server is on by default. Audit provides a security-relevant chronological set of records documenting the sequence of activities that have affected the system by individual users, administrators, or other components of the system. Audit works at the API server level, logging all requests coming to the server. Each audit log contains two entries:
The request line containing:
A Unique ID allowing to match the response line (see #2)
The response line containing:
You can view logs for the OpenShift Container Platform API server or the Kubernetes API server for each master node. Follow the steps in documentation.
Use the following command to view the audit log profile:
oc get apiserver cluster -o json | jq .spec.audit.profile
Verify the result is not None, which means audit logging is disabled.
Review the audit log configuration for the OpenShift and Kubernetes API servers using the following commands:
oc get cm -n openshift-apiserver config -o json | jq -r '.data."config.yaml"' | jq .apiServerArguments
oc get cm -n openshift-kube-apiserver config -o json | jq -r '.data."config.yaml"' | jq .apiServerArguments
Review the audit policies for the OpenShift and Kubernetes API servers using the following commands:
oc get cm -n openshift-apiserver audit -o json | jq -r '.data."policy.yaml"'
oc get cm -n openshift-kube-apiserver kube-apiserver-audit-policies -o json | jq -r '.data."policy.yaml"'
Verify the returned configuration and ensure it aligns with data retention and storage requirements for the deployment.
Use the following command to view Kubernetes API server audit logs:
oc adm node-logs --role=master --path=kube-apiserver/
Verify logs are returned.
Use the following command to view OpenShift API server audit logs:
oc adm node-logs --role=master --path=openshift-apiserver/
Verify logs are returned.
None.
Auditing logging is enabled by default, using the Default audit profile.
Please reference the OpenShift audit logging documentation for more information on various profiles and configuration guidance.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.2 Collect Audit Logs | X | X | X |
| v7 | 6.2 Activate audit logging | X | X | X |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1543 | TA0003, TA0004 | M1026 |
Level 1 (Manual)