MKE must be configured to send audit data to a centralized log server.

An XCCDF Rule

Description

<VulnDiscussion>Sending audit data from MKE to a centralized log server enhances centralized monitoring, facilitates efficient incident response, scales effectively, provides redundancy, and helps organizations meet compliance requirements. This is the recommended best practice for managing Kubernetes environments, especially in enterprise settings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-260915r966102_rule
Severity: Medium
References: CCI-000140 CCI-000154 CCI-001851 CCI-002702
Updated: 19 days ago

Configure logging driver by setting the log-driver and log-opts keys to appropriate values in the daemon.json file. Refer to this link for extra assistance: https://docs.docker.com/config/containers/logging/syslog/.

Via CLI:
Linux:
1. As a trusted user on the host OS, open the /etc/docker/daemon.json file for editing. If the file does not exist, it must be created.
2. Set the "log-driver" property to one of the following: 
"syslog", "journald", or "<plugin>" (where <plugin> is the naming of a third-party MKE logging driver plugin).
Note: Mirantis recommends the "journald" setting.

The following example sets the log driver to journald:

{
  "log-driver": "journald"
}


3. Configure the "log-opts" object as required by the selected "log-driver".

4. Save the file.

5. Restart the Docker daemon by executing the following:

sudo systemctl restart docker

Configure rsyslog to send logs to the SEIM system.

1. Edit the /etc/rsyslog.conf file and add the IP address of remote server.
Example: *.* @@loghost.example.com

2. Work with the SIEM administrator to configure an alert when no audit data is received from Mirantis.

MKE must be configured to send audit data to a centralized log server.

Description

Remediation - Manual Procedure