Detections
Analytics

Item Search

NameAudit NamePluginCategory
3.1.1 Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictiveCIS Google Kubernetes Engine (GKE) v1.3.0 L1 NodeUnix
3.1.1 Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictiveCIS Google Kubernetes Engine (GKE) v1.4.0 L1 NodeUnix
3.1.2 Ensure that the proxy kubeconfig file ownership is set to root:rootCIS Google Kubernetes Engine (GKE) v1.4.0 L1 NodeUnix
3.1.2 Ensure that the proxy kubeconfig file ownership is set to root:rootCIS Google Kubernetes Engine (GKE) v1.3.0 L1 NodeUnix
3.1.3 Ensure that the kubelet configuration file has permissions set to 644 or more restrictiveCIS Google Kubernetes Engine (GKE) v1.3.0 L1 NodeUnix
3.1.4 Ensure that the kubelet configuration file ownership is set to root:rootCIS Google Kubernetes Engine (GKE) v1.3.0 L1 NodeUnix
3.1.4 Ensure that the kubelet configuration file ownership is set to root:rootCIS Google Kubernetes Engine (GKE) v1.4.0 L1 NodeUnix
4.1.2 Minimize access to secretsCIS Google Kubernetes Engine (GKE) v1.4.0 L1GCP
4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictiveCIS RedHat OpenShift Container Platform 4 v1.3.0 L1OpenShift
4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictiveCIS RedHat OpenShift Container Platform 4 v1.4.0 L1OpenShift
4.2 Ensure that containers use only trusted base imagesCIS Docker v1.5.0 L1 Docker LinuxUnix
4.3 Ensure that unnecessary packages are not installed in the containerCIS Docker v1.5.0 L1 Docker LinuxUnix
4.6 Ensure that HEALTHCHECK instructions have been added to container imagesCIS Docker v1.5.0 L1 Docker LinuxUnix
4.7 Ensure update instructions are not used alone in DockerfilesCIS Docker v1.5.0 L1 Docker LinuxUnix
4.8 Ensure Compute Instances Are Launched With Shielded VM EnabledCIS Google Cloud Platform v1.3.0 L2GCP
4.8 Ensure Compute Instances Are Launched With Shielded VM EnabledCIS Google Cloud Platform v2.0.0 L2GCP
4.9 Ensure that COPY is used instead of ADD in DockerfilesCIS Docker v1.5.0 L1 Docker LinuxUnix
5.1 Ensure that, if applicable, an AppArmor Profile is enabledCIS Docker v1.5.0 L1 Docker LinuxUnix
5.1.4 Minimize access to create podsCIS RedHat OpenShift Container Platform 4 v1.4.0 L1OpenShift
5.1.4 Minimize access to create podsCIS RedHat OpenShift Container Platform 4 v1.2.0 L1OpenShift
5.1.4 Minimize access to create podsCIS RedHat OpenShift Container Platform 4 v1.3.0 L1OpenShift
5.1.4 Minimize access to create podsCIS RedHat OpenShift Container Platform 4 v1.5.0 L1OpenShift
5.2 Ensure that, if applicable, SELinux security options are setCIS Docker v1.5.0 L2 Docker LinuxUnix
5.2.2 Minimize the admission of containers wishing to share the host process ID namespaceCIS RedHat OpenShift Container Platform 4 v1.4.0 L1OpenShift
5.2.2 Minimize the admission of containers wishing to share the host process ID namespaceCIS RedHat OpenShift Container Platform 4 v1.5.0 L1OpenShift
5.2.7 Minimize the admission of containers with the NET_RAW capabilityCIS RedHat OpenShift Container Platform 4 v1.2.0 L1OpenShift
5.2.8 Minimize the admission of containers with added capabilities - allowedCapabilitiesCIS RedHat OpenShift Container Platform 4 v1.2.0 L1OpenShift
5.2.8 Minimize the admission of containers with added capabilities - allowedCapabilitiesCIS RedHat OpenShift Container Platform 4 v1.5.0 L1OpenShift
5.2.8 Minimize the admission of containers with added capabilities - allowedCapabilitiesCIS RedHat OpenShift Container Platform 4 v1.3.0 L1OpenShift
5.2.8 Minimize the admission of containers with added capabilities - allowedCapabilitiesCIS RedHat OpenShift Container Platform 4 v1.4.0 L1OpenShift
5.2.8 Minimize the admission of containers with added capabilities - defaultAddCapabilitiesCIS RedHat OpenShift Container Platform 4 v1.5.0 L1OpenShift
5.2.8 Minimize the admission of containers with added capabilities - defaultAddCapabilitiesCIS RedHat OpenShift Container Platform 4 v1.2.0 L1OpenShift
5.2.8 Minimize the admission of containers with the NET_RAW capabilityCIS Kubernetes Benchmark v1.7.1 L1 MasterUnix
5.2.9 Minimize the admission of containers with added capabilitiesCIS Kubernetes Benchmark v1.7.1 L1 MasterUnix
5.2.9 Minimize the admission of containers with added capabilitiesCIS Kubernetes Benchmark v1.8.0 L1 MasterUnix
5.2.9 Minimize the admission of containers with capabilities assignedCIS RedHat OpenShift Container Platform 4 v1.4.0 L2OpenShift
5.2.10 Minimize the admission of containers with capabilities assignedCIS Kubernetes Benchmark v1.8.0 L2 MasterUnix
5.2.10 Minimize the admission of containers with capabilities assignedCIS Kubernetes Benchmark v1.7.1 L2 MasterUnix
5.3 Ensure that Linux kernel capabilities are restricted within containersCIS Docker v1.5.0 L1 Docker LinuxUnix
5.4.1 Ensure legacy Compute Engine instance metadata APIs are DisabledCIS Google Kubernetes Engine (GKE) v1.3.0 L1GCP
5.4.1 Ensure legacy Compute Engine instance metadata APIs are DisabledCIS Google Kubernetes Engine (GKE) v1.4.0 L1GCP
5.4.2 Ensure the GKE Metadata Server is EnabledCIS Google Kubernetes Engine (GKE) v1.4.0 L2GCP
5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controllerCIS Kubernetes Benchmark v1.7.1 L2 MasterUnix
5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controllerCIS Kubernetes Benchmark v1.8.0 L2 MasterUnix
5.5.1 Ensure Container-Optimized OS (cos_containerd) is used for GKE node imagesCIS Google Kubernetes Engine (GKE) v1.3.0 L2GCP
5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitionsCIS RedHat OpenShift Container Platform 4 v1.3.0 L2OpenShift
5.10.5 Ensure use of Binary AuthorizationCIS Google Kubernetes Engine (GKE) v1.4.0 L2GCP
5.10.5 Ensure use of Binary AuthorizationCIS Google Kubernetes Engine (GKE) v1.3.0 L2GCP
5.14 Ensure that the 'on-failure' container restart policy is set to '5'CIS Docker v1.5.0 L1 Docker LinuxUnix
5.27 Ensure that Docker commands always make use of the latest version of their imageCIS Docker v1.5.0 L1 Docker LinuxUnix