Ensure the notification is enabled for file integrity operator
An XCCDF Rule
Description
The OpenShift platform provides the File Integrity Operator to monitor for unwanted file changes, and this control ensures proper notification alert is enabled so that system administrators and security personnel are notified about the alerts
warning alert: Warning
This rule's check operates on the cluster configuration dump.
Therefore, you need to use a tool that can query the OCP API, retrieve the following:
-
/apis/monitoring.coreos.com/v1/prometheusrulesAPI endpoint, filter with with thejqutility using the following filter[.items[] | select(.metadata.name =="file-integrity") | .metadata.name]and persist it to the local
Rationale
File Integrity Operator is able to send out alerts
- ID
- xccdf_org.ssgproject.content_rule_file_integrity_notification_enabled
- Severity
- Medium
- References
- Updated