CIP-007-3 R.1.3

1 rule found Severity: Medium

26 rules found Severity: Medium

29 rules found Severity: Medium

14 rules found Severity: Medium

33 rules found Severity: Medium

11 rules found Severity: Medium

26 rules found Severity: Medium

25 rules found Severity: Medium

26 rules found Severity: Medium

30 rules found

26 rules found Severity: Medium

30 rules found

17 rules found Severity: Medium

20 rules found Severity: Medium

13 rules found Severity: Medium

20 rules found Severity: Medium

13 rules found Severity: Medium

20 rules found Severity: Medium

12 rules found Severity: Medium

1 rule found Severity: Medium

Ensure that Audit Log Forwarding Is Enabled

Configure An Identity Provider

Do Not Use htpasswd-based IdP

Ensure that the kubeadmin secret has been removed

Set Account Expiration Following Inactivity

Record Events that Modify User/Group Information

Set existing passwords a period of inactivity before they been locked

Ensure auditd Collects Information on the Use of Privileged Commands

Record Events that Modify User/Group Information via open syscall - /etc/group

Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group

Record Events that Modify User/Group Information via openat syscall - /etc/group

Record Events that Modify User/Group Information via open syscall - /etc/gshadow

Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow

Record Events that Modify User/Group Information via openat syscall - /etc/gshadow

Record Events that Modify User/Group Information via open syscall - /etc/passwd

Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd

Record Events that Modify User/Group Information via openat syscall - /etc/passwd

Record Events that Modify User/Group Information via open syscall - /etc/shadow

Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow

Record Events that Modify User/Group Information via openat syscall - /etc/shadow

Record Events that Modify User/Group Information - /etc/group

Record Events that Modify User/Group Information - /etc/gshadow

Record Events that Modify User/Group Information - /etc/security/opasswd

Record Events that Modify User/Group Information - /etc/passwd

Enable rsyslog to Accept Messages via TCP, if Acting As Log Server

Record Events that Modify User/Group Information - /etc/shadow

Enable rsyslog to Accept Messages via UDP, if Acting As Log Server

Record Any Attempts to Run semanage

Ensure auditd Collects Information on the Use of Privileged Commands - chage

Ensure auditd Collects Information on the Use of Privileged Commands - chsh

Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd

Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap

Ensure auditd Collects Information on the Use of Privileged Commands - newgrp

Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap

Ensure auditd Collects Information on the Use of Privileged Commands - passwd

Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd

Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl

Ensure that the cluster's audit profile is properly set

Ensure that API server audit logging is enabled