public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-29 14:38:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix links

Browse Source
This commit is contained in:
Billy Tat
2022-09-01 14:57:40 -07:00
parent 827906a2b7
commit ce19e2e8be
66 changed files with 175 additions and 177 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/pages-for-subheaders/cis-scan-guides.md
+12 -12
View File
@@ -31,7 +31,7 @@ The Center for Internet Security is a 501(c\)(3) non-profit organization, formed
CIS Benchmarks are best practices for the secure configuration of a target system. CIS Benchmarks are developed through the generous volunteer efforts of subject matter experts, technology vendors, public and private community members, and the CIS Benchmark Development team.
The official Benchmark documents are available through the CIS website. The sign-up form to access the documents is
The official Benchmark documents are available through the CIS website. The sign-up form to access the documents is
<a href="https://learn.cisecurity.org/benchmarks" target="_blank">here.</a>
# About the Generated Report
@@ -44,7 +44,7 @@ The Benchmark version is included in the generated report.
The Benchmark provides recommendations of two types: Automated and Manual. Recommendations marked as Manual in the Benchmark are not included in the generated report.
Some tests are designated as "Not Applicable." These tests will not be run on any CIS scan because of the way that Rancher provisions RKE clusters. For information on how test results can be audited, and why some tests are designated to be not applicable, refer to Rancher's <a href="security/#the-cis-benchmark-and-self-assessment" target="_blank">self-assessment guide for the corresponding Kubernetes version.</a>
Some tests are designated as "Not Applicable." These tests will not be run on any CIS scan because of the way that Rancher provisions RKE clusters. For information on how test results can be audited, and why some tests are designated to be not applicable, refer to Rancher's [self-assessment guide](./rancher-security.md#the-cis-benchmark-and-self-assessment) for the corresponding Kubernetes version.</a>
The report contains the following information:
@@ -94,7 +94,7 @@ There are two types of RKE cluster scan profiles:
The EKS and GKE cluster scan profiles are based on CIS Benchmark versions that are specific to those types of clusters.
In order to pass the "Hardened" profile, you will need to follow the steps on the <a href="security/#rancher-hardening-guide" target="_blank">hardening guide</a> and use the `cluster.yml` defined in the hardening guide to provision a hardened cluster.
In order to pass the "Hardened" profile, you will need to follow the steps on the [hardening guide](./rancher-security.md#rancher-hardening-guide) and use the `cluster.yml` defined in the hardening guide to provision a hardened cluster.
The default profile and the supported CIS benchmark version depends on the type of cluster that will be scanned:
@@ -107,7 +107,7 @@ The `rancher-cis-benchmark` supports the CIS 1.6 Benchmark version.
# About Skipped and Not Applicable Tests
For a list of skipped and not applicable tests, refer to <a href="cis-scans/skipped-tests" target="_blank">this page.</a>
For a list of skipped and not applicable tests, refer to [this page](../explanations/integrations-in-rancher/cis-scans/skipped-and-not-applicable-tests.md).
For now, only user-defined skipped tests are marked as skipped in the generated report.
@@ -115,11 +115,11 @@ Any skipped tests that are defined as being skipped by one of the default profil
# Roles-based Access Control
For information about permissions, refer to <a href="cis-scancis-scans/rbac" target="_blank">this page.</a>
For information about permissions, refer to [this page](../explanations/integrations-in-rancher/cis-scans/rbac-for-cis-scans.md).
# Configuration
For more information about configuring the custom resources for the scans, profiles, and benchmark versions, refer to <a href="cis-scancis-scans/configuration" target="_blank">this page.</a>
For more information about configuring the custom resources for the scans, profiles, and benchmark versions, refer to [this page](../explanations/integrations-in-rancher/cis-scans/configuration-reference.md).
# How-to Guides
@@ -179,7 +179,7 @@ To run a ClusterScan on a schedule,
1. Choose a **Retention** count, which indicates the number of reports maintained for this recurring scan. By default this count is 3. When this retention limit is reached, older reports will get purged.
1. Click **Create**.
**Result:** The scan runs and reschedules to run according to the cron schedule provided. The **Next Scan** value indicates the next time this scan will run again.
**Result:** The scan runs and reschedules to run according to the cron schedule provided. The **Next Scan** value indicates the next time this scan will run again.
A report is generated with the scan results every time the scan runs. To see the latest results, click the name of the scan that appears.
@@ -233,11 +233,11 @@ One can download the report from the Scans list or from the scan detail page.
Alerts can be configured to be sent out for a scan that runs on a schedule.
:::note Prerequisite:
:::note Prerequisite:
Before enabling alerts for `rancher-cis-benchmark`, make sure to install the `rancher-monitoring` application and configure the Receivers and Routes. For more information, see [this section.](monitoring-alertincis-scans/configuration)
Before enabling alerts for `rancher-cis-benchmark`, make sure to install the `rancher-monitoring` application and configure the Receivers and Routes. For more information, see [this section.](./monitoring-v2-configuration-guides.md)
While configuring the routes for `rancher-cis-benchmark` alerts, you can specify the matching using the key-value pair `job: rancher-cis-scan`. An example route configuration is [here.](monitoring-alertincis-scans/configuration/receiver/#example-route-config-for-cis-scan-alerts)
While configuring the routes for `rancher-cis-benchmark` alerts, you can specify the matching using the key-value pair `job: rancher-cis-scan`. An example route configuration is [here.](../reference-guides/monitoring-v2-configuration/receivers.md#example-route-config-for-cis-scan-alerts)
:::
@@ -287,8 +287,8 @@ To configure alerts for a scan that runs on a schedule,
A report is generated with the scan results every time the scan runs. To see the latest results, click the name of the scan that appears.
### Creating a Custom Benchmark Version for Running a Cluster Scan
### Creating a Custom Benchmark Version for Running a Cluster Scan
There could be some Kubernetes cluster setups that require custom configurations of the Benchmark tests. For example, the path to the Kubernetes config files or certs might be different than the standard location where the upstream CIS Benchmarks look for them.
It is now possible to create a custom Benchmark Version for running a cluster scan using the `rancher-cis-benchmark` application.