Add Kubernetes CIS Benchmark integration

.github/CODEOWNERS

@@ -23,6 +23,7 @@
 /packages/cassandra @elastic/integrations
 /packages/cef @elastic/security-external-integrations
 /packages/checkpoint @elastic/security-external-integrations
+/packages/cis_kubernetes_benchmark @elastic/cloud-security-posture
 /packages/cisco_asa @elastic/security-external-integrations
 /packages/cisco_duo @elastic/security-external-integrations
 /packages/cisco_ftd @elastic/security-external-integrations

packages/cis_kubernetes_benchmark/changelog.yml

@@ -0,0 +1,6 @@
+# newer versions go on top
+- version: "0.0.1"
+  changes:
+    - description: Initial draft of the package
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/2930

packages/cis_kubernetes_benchmark/data_stream/findings/agent/stream/stream.yml.hbs

@@ -0,0 +1,2 @@
+processors:
+  - add_cluster_id: ~

packages/cis_kubernetes_benchmark/data_stream/findings/fields/base-fields.yml

@@ -0,0 +1,12 @@
+- name: data_stream.type
+  type: constant_keyword
+  description: Data stream type.
+- name: data_stream.dataset
+  type: constant_keyword
+  description: Data stream dataset.
+- name: data_stream.namespace
+  type: constant_keyword
+  description: Data stream namespace.
+- name: '@timestamp'
+  type: date
+  description: Event timestamp.

packages/cis_kubernetes_benchmark/data_stream/findings/fields/findings.yml

@@ -0,0 +1,81 @@
+- name: cycle_id
+  type: text
+  multi_fields:
+    - name: keyword
+      type: keyword
+      ignore_above: 1024
+- name: type
+  type: text
+  multi_fields:
+    - name: keyword
+      type: keyword
+      ignore_above: 1024
+- name: resource_id
+  type: text
+  multi_fields:
+    - name: keyword
+      type: keyword
+      ignore_above: 1024
+- name: cluster_id
+  type: text
+  multi_fields:
+    - name: keyword
+      type: keyword
+      ignore_above: 1024
+- name: agent
+  type: group
+  fields:
+    - name: id
+      type: text
+      description: Agent ID
+      multi_fields:
+        - name: keyword
+          type: keyword
+          ignore_above: 1024
+- name: resource
+  type: group
+  fields:
+    - name: type
+      type: text
+      description: Source type of the resource
+      multi_fields:
+        - name: keyword
+          type: keyword
+          ignore_above: 1024
+    - name: filename
+      type: text
+      description: Resource filename
+      multi_fields:
+        - name: keyword
+          type: keyword
+          ignore_above: 1024
+- name: rule
+  type: group
+  fields:
+    - name: name
+      type: keyword
+      description: Rule name
+      multi_fields:
+        - name: keyword
+          type: keyword
+          ignore_above: 1024
+    - name: benchmark
+      type: group
+      fields:
+        - name: name
+          type: text
+          description: Benchmark name
+          multi_fields:
+            - name: keyword
+              type: keyword
+              ignore_above: 1024
+- name: result
+  type: group
+  fields:
+    - name: evaluation
+      type: text
+      description: Rule result
+      multi_fields:
+        - name: keyword
+          type: keyword
+          ignore_above: 1024

packages/cis_kubernetes_benchmark/data_stream/findings/manifest.yml

@@ -0,0 +1,6 @@
+title: "Findings"
+type: logs
+streams:
+  - input: cloudbeat
+    title: K8s CIS Compliance
+    description: Check CIS Benchmark compliance

packages/cis_kubernetes_benchmark/docs/README.md

@@ -0,0 +1,28 @@
+# CIS Kubernetes Benchmark
+
+This integration compares [Kubernetes](https://kubernetes.io/) configuration against CIS benchmark checks. It computes a score that ranges between 0 - 100. This integration requires access to node files, node processes, and the Kuberenetes api-server therefore it assumes the agent will be installed as a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) with the proper [Roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole) and [RoleBindings](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding) attached.
+
+See agent [installation instructions](https://www.elastic.co/guide/en/fleet/current/running-on-kubernetes-managed-by-fleet.html).
+
+Additionally, In order for the integration to be installed, The Cloud Security Posture Kibana plugin must be enabled.
+
+This could be done by adding the following configuration line to `kibana.yml`:
+```
+xpack.cloudSecurityPosture.enabled: true
+```
+
+## Leader election
+
+To collect cluster level data (compared to node level information) the integration makes use of the [leader election](https://www.elastic.co/guide/en/fleet/master/kubernetes_leaderelection-provider.html) mechanism.
+This mechanism assures that the cluster level data is collected by only one of the agents running as aprt of the DeamonSet and not by all of them.
+
+Cluster level data example: List of the running pods.
+Node level data examle: kubelet configuration.
+
+## Compatibility
+
+The Kubernetes package is tested with Kubernetes 1.21.x
+
+## Dashboard
+
+CIS Kubernetes Benchmark integration is shipped including default dashboards and screens to manage the benchmark rules and inspect the compliance score and findings.

packages/cis_kubernetes_benchmark/kibana/index_pattern/cis_kubernetes_benchmark-9129a080-7f48-11ec-8249-431333f83c5f.json

@@ -0,0 +1,14 @@
+{
+    "attributes": {
+        "description": "",
+        "title": "logs-cis_kubernetes_benchmark.findings-*"
+    },
+    "coreMigrationVersion": "8.1.0",
+    "id": "cis_kubernetes_benchmark-9129a080-7f48-11ec-8249-431333f83c5f",
+    "migrationVersion": {
+        "index-pattern": "8.0.0"
+    },
+    "type": "index-pattern",
+    "updated_at": "2022-01-27T08:10:19.277Z",
+    "version": "WzMwNDY5LDFd"
+}

packages/cis_kubernetes_benchmark/manifest.yml

@@ -0,0 +1,57 @@
+format_version: 1.0.0
+name: cis_kubernetes_benchmark
+title: "CIS Kubernetes Benchmark"
+version: 0.0.1
+license: basic
+description: "Check Kubernetes cluster compliance with the Kubernetes CIS benchmark."
+type: integration
+categories:
+  - containers
+  - kubernetes
+release: experimental
+conditions:
+  kibana.version: "^8.2.0"
+screenshots:
+  - src: /img/dashboard.png
+    title: Dashboard page
+    size: 1293x718
+    type: image/png
+  - src: /img/findings.png
+    title: Findings page
+    size: 3134x1740
+    type: image/png
+  - src: /img/findings-flyout.png
+    title: Detailed view of a single finding
+    size: 3176x1748
+    type: image/png
+  - src: /img/benchmarks.png
+    title: Benchmarks page
+    size: 3168x1752
+    type: image/png
+  - src: /img/rules.png
+    title: Rules page
+    size: 3160x1708
+    type: image/png
+icons:
+  - src: /img/cis-kubernetes-benchmark-logo.svg
+    title: CIS Kubernetes Benchmark logo
+    size: 32x32
+    type: image/svg+xml
+policy_templates:
+  - name: findings
+    title: Compliance findings
+    description: Collect findings
+    multiple: false
+    inputs:
+      - type: cloudbeat
+        title: Enable CIS Kubernetes Benchmark
+        description: Collecting findings
+vars:
+  - name: dataYaml
+    type: yaml
+    title: Rules Activation Yaml
+    multi: false
+    required: false
+    show_user: false
+owner:
+  github: elastic/cloud-security-posture