Skip to content

Updates cloud section #6714

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions docs/cloud-native-security/cspm-faq.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,12 @@ After you deploy the CSPM integration, it can take up to 10 minutes for resource

Newly unenrolled cloud accounts can take a maximum of 24 hours to disappear from the Cloud Security Posture dashboard.

**Can I install an unlimited number of agentless integrations?**

Each agentless integration deployment counts towards the maximum number of agentless integrations you can have in the same project. When you reach the maximum, you'll see an error message similar to `You have deployed the maximum number of agentless integrations. To continue, remove some or use agent-based deployment.` You won't be able to deploy another agentless integration until you remove an existing one. All <<agentless-integrations>> count towards this limit.




[discrete]
== KSPM FAQ
Expand All @@ -31,30 +37,38 @@ Frequently asked questions about the Kubernetes Security Posture Management (KSP
For self-managed/vanilla and EKS clusters, Kubernetes version 1.23 is supported.

*Do benchmark rules support multiple Kubernetes deployment types?*

Yes. There are different sets of benchmark rules for self-managed and third party-managed deployments. Refer to <<get-started-with-kspm,Get started with KSPM>> for more information about setting up each deployment type.

*Can I evaluate the security posture of my Amazon EKS clusters?*

Yes. KSPM currently supports the security posture evaluation of Amazon EKS and unmanaged Kubernetes clusters.

*How often is my cluster’s security posture evaluated?*

Clusters are evaluated when you deploy a KSPM integration, and every four hours after that.

*When do newly-enrolled clusters appear on the dashboard?*

It can take up to 10 minutes for deployment, resource fetching, evaluation, and data processing to complete before a newly-enrolled cluster appears on the dashboard.

*When do unenrolled clusters disappear from the dashboard?*

A cluster will disappear as soon as the KSPM integration fetches data while that cluster is not enrolled. The fetch process repeats every four hours, which means a newly unenrolled cluster can take a maximum of four hours to disappear from the dashboard.

[discrete]
== Findings page

*Are all the findings page current?*

Yes. Only the most recent findings appear on the Findings page.

*Can I build custom visualizations and dashboards that incorporate findings data?*

Yes. You can use {kib}'s custom visualization capabilities with findings data. To learn more, refer to {kibana-ref}/dashboard.html[Dashboards and visualizations].

*Where is Findings data saved?*

You can access findings data using the following index patterns:

* **Current findings:** `logs-cloud_security_posture.findings_latest-*`
Expand All @@ -65,15 +79,19 @@ You can access findings data using the following index patterns:
== Benchmark rules

*How often are my resources evaluated against benchmark rules?*

Resources are fetched and evaluated against benchmark rules when a security posture management integration is deployed. After that, the CSPM integration evaluates every 24 hours, and the KSPM integration evaluates every four hours.

*Can I configure an integration's fetch cycle?*

No, the fetch cycle's timing is not configurable.

*Can I contribute to the CSP ruleset?*

You can't directly edit benchmark rules. The rules are defined https://github.com/elastic/csp-security-policies[in this repository], where you can raise issues with certain rules. They are written in https://www.openpolicyagent.org/docs/latest/policy-language/[Rego].

*How can I tell which specific version of the CIS benchmarks is in use?*

Refer to the `rule.benchmark.name` and `rule.benchmark.version` fields for documents in these datastreams:

* `logs-cloud_security_posture.findings-default`
Expand Down
31 changes: 29 additions & 2 deletions docs/getting-started/agentless-integrations.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,33 @@

Agentless integrations provide a means to ingest data while avoiding the orchestration, management, and maintenance needs associated with standard ingest infrastructure. Using agentless integrations makes manual agent deployment unnecessary, allowing you to focus on your data instead of the agent that collects it.

We currently support one agentless integration: cloud security posture management (CSPM). Using this integration's agentless deployment option, you can enable Elastic's CSPM capabilities just by providing the necessary credentials. Agentless CSPM deployments support AWS, Azure, and GCP accounts.
We support the following integrations:

To learn more about agentless CSPM deployments, refer to the getting started guides for CSPM on <<cspm-get-started, AWS>>, <<cspm-get-started-azure, Azure>>, or <<cspm-get-started-gcp, GCP>>.
[discrete]
== Generally available (GA) agentless integrations

Cloud security posture management (CSPM). Using this integration's agentless deployment option, you can enable Elastic's CSPM capabilities just by providing the necessary credentials. Agentless CSPM deployments support AWS, Azure, and GCP accounts.

To learn more about agentless CSPM deployments, refer to the getting started guides for CSPM on <<cspm-get-started, AWS>>, <<cspm-get-started-azure, Azure>>, or <<cspm-get-started-gcp, GCP>>.

[discrete]
== Beta agentless integrations

WARNING: Agentless deployment for the following integrations is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.

* AbuseCH
* CrowdStrike
* Google SecOps
* Google Security Command Center
* Google Workspace
* Microsoft 365 Defender
* Microsoft Defender for Endpoint
* Microsoft Sentinel
* Okta
* Qualys VMDR
* SentinelOne Zscaler
* Tenable IO
* Wiz
* Zscaler ZIA

To learn more about these integrations and find setup guides, refer to {integrations-docs}[Elastic integrations].