用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-k8s-v200-3-2-2命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-k8s-v200-3.2.2 |
| description | Ensure that the audit policy covers key security concerns (Manual) |
| category | cis-k8s |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","kubernetes","control-plane-config","logging"] |
| cis_id | 3.2.2 |
| cis_benchmark | CIS Kubernetes Benchmark v2.0.0 |
| tech_stack | ["kubernetes"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Ensure that the audit policy created for the cluster covers key security concerns.
Security audit logs should cover access and modification of key resources in the cluster, to enable them to form an effective part of a security environment.
Increasing audit logging will consume resources on the nodes or other log destination.
Review the audit policy provided for the cluster and ensure that it covers at least the following areas:
pod and deployment objects.pods/exec, pods/portforward, pods/proxy and services/proxy.CertificateSigningRequest API which allows for creation of new credentials.Token sub-resource of ServiceAccount objects which allows for creation of new credentials.For most requests, minimally logging at the Metadata level is recommended (the most basic level of logging). Exceptions should be created in the audit logging policy to ensure that system operations (e.g. the Kubelet creating new credentials) are not logged, to reduce operational load and the risk of false positives.
Consider modification of the audit policy in use on the cluster to include these items, at a minimum.
By default Kubernetes clusters do not log audit information.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|
| v8 | 8.5 Collect Detailed Audit Logs Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation. | ● | ● | |
| v7 | 14.9 Enforce Detail Logging for Access or Changes to Sensitive Data Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools such as File Integrity Monitoring or Security Information and Event Monitoring). | ● |
Level 2 - Master Node (Manual)