1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([["3207"],{71283:function(e,t,r){r.r(t),r.d(t,{frontMatter:()=>d,toc:()=>h,default:()=>a,metadata:()=>s,assets:()=>l,contentTitle:()=>c});var s=JSON.parse('{"id":"reference/resources/compliance-reports/cis-benchmark","title":"CIS benchmark report","description":"API for this resource.","source":"@site/calico-enterprise_versioned_docs/version-3.19-2/reference/resources/compliance-reports/cis-benchmark.mdx","sourceDirName":"reference/resources/compliance-reports","slug":"/reference/resources/compliance-reports/cis-benchmark","permalink":"/calico-enterprise/3.19/reference/resources/compliance-reports/cis-benchmark","draft":false,"unlisted":false,"editUrl":"https://github.com/tigera/docs/edit/main/calico-enterprise_versioned_docs/version-3.19-2/reference/resources/compliance-reports/cis-benchmark.mdx","tags":[],"version":"3.19-2","frontMatter":{"description":"API for this resource."},"sidebar":"calicoEnterpriseSidebar","previous":{"title":"Policy audit report","permalink":"/calico-enterprise/3.19/reference/resources/compliance-reports/policy-audit"},"next":{"title":"Deep packet inspection","permalink":"/calico-enterprise/3.19/reference/resources/deeppacketinspection"}}'),n=r(70689),i=r(17869);let d={description:"API for this resource."},c="CIS benchmark report",l={},h=[{value:"Openshift",id:"openshift",level:2},{value:"Downloadable reports",id:"downloadable-reports",level:2},{value:"total-summary.csv",id:"total-summarycsv",level:2},{value:"node-summary.csv",id:"node-summarycsv",level:2},{value:"failed-tests.csv",id:"failed-testscsv",level:3},{value:"all-tests.csv",id:"all-testscsv",level:3}];function o(e){let t={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.header,{children:(0,n.jsx)(t.h1,{id:"cis-benchmark-report",children:"CIS benchmark report"})}),"\n",(0,n.jsxs)(t.p,{children:["To create a CIS benchmark report, create a ",(0,n.jsx)(t.code,{children:"GlobalReport"})," with the ",(0,n.jsx)(t.code,{children:"reportType"})," set to ",(0,n.jsx)(t.code,{children:"cis-benchmark"}),"."]}),"\n",(0,n.jsx)(t.p,{children:"The following sample command uses a GlobalReport to create a daily CIS benchmark report that run on all the nodes."}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"kubectl apply -f - << EOF\napiVersion: projectcalico.org/v3\nkind: GlobalReport\nmetadata:\n name: daily-cis-benchmark-report\nspec:\n reportType: cis-benchmark\n schedule: 0 0 * * *\nEOF\n"})}),"\n",(0,n.jsx)(t.h2,{id:"openshift",children:"Openshift"}),"\n",(0,n.jsxs)(t.p,{children:["While there is no extra setup configuration required by the user to generate a benchmark report for Openshift, the result sets will be different than a report generated for regular Kubernetes clusters. Use the ",(0,n.jsx)(t.a,{href:"https://static.open-scap.org/ssg-guides/ssg-ocp4-guide-index.html",children:"Openshift Container Platform Security Guide"})," to cross-reference the benchmark results."]}),"\n",(0,n.jsx)(t.h2,{id:"downloadable-reports",children:"Downloadable reports"}),"\n",(0,n.jsx)(t.h2,{id:"total-summarycsv",children:"total-summary.csv"}),"\n",(0,n.jsx)(t.p,{children:"A textual representation of the dashboard."}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"Heading"}),(0,n.jsx)(t.th,{children:"Description"}),(0,n.jsx)(t.th,{children:"Format"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"startTime"}),(0,n.jsx)(t.td,{children:"The report interval start time."}),(0,n.jsx)(t.td,{children:"RFC3339 string"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"endTime"}),(0,n.jsx)(t.td,{children:"The report interval start time."}),(0,n.jsx)(t.td,{children:"RFC3339 string"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"type"}),(0,n.jsx)(t.td,{children:"The type of benchmark report"}),(0,n.jsx)(t.td,{children:"string"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"hiPercentageThreshold"}),(0,n.jsx)(t.td,{children:"The percentage of passing tests required to rate a node as high"}),(0,n.jsx)(t.td,{children:"int"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"medPercentageThreshold"}),(0,n.jsx)(t.td,{children:"The percentage of passing tests required to rate a node as medium"}),(0,n.jsx)(t.td,{children:"int"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"hiNodeCount"}),(0,n.jsx)(t.td,{children:"The number of nodes rated as high"}),(0,n.jsx)(t.td,{children:"int"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"medNodeCount"}),(0,n.jsx)(t.td,{children:"The number of nodes rated as medium"}),(0,n.jsx)(t.td,{children:"int"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"lowNodeCount"}),(0,n.jsx)(t.td,{children:"The number of nodes rated as low"}),(0,n.jsx)(t.td,{children:"int"})]})]})]}),"\n",(0,n.jsx)(t.h2,{id:"node-summarycsv",children:"node-summary.csv"}),"\n",(0,n.jsx)(t.p,{children:"A .csv file of test result summaries per node."}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"Heading"}),(0,n.jsx)(t.th,{children:"Description"}),(0,n.jsx)(t.th,{children:"Format"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"node"}),(0,n.jsx)(t.td,{children:"The name of the node."}),(0,n.jsx)(t.td,{children:"string"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"version"}),(0,n.jsx)(t.td,{children:"The version of the platform."}),(0,n.jsx)(t.td,{children:"string"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"status"}),(0,n.jsx)(t.td,{children:"The rating of the node based on percentage of tests passing."}),(0,n.jsx)(t.td,{children:"string"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"testsPassing"}),(0,n.jsx)(t.td,{children:"The number of tests passing."}),(0,n.jsx)(t.td,{children:"int"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"testsFailing"}),(0,n.jsx)(t.td,{children:"The number of tests failing."}),(0,n.jsx)(t.td,{children:"int"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"testsUnknown"}),(0,n.jsx)(t.td,{children:"The number of tests whose results are undetermined due to automation restrictions."}),(0,n.jsx)(t.td,{children:"int"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"testsTotal"}),(0,n.jsx)(t.td,{children:"The total number of tests executed."}),(0,n.jsx)(t.td,{children:"int"})]})]})]}),"\n",(0,n.jsx)(t.h3,{id:"failed-testscsv",children:"failed-tests.csv"}),"\n",(0,n.jsx)(t.p,{children:"A .csv file of tests that have failed."}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"Heading"}),(0,n.jsx)(t.th,{children:"Description"}),(0,n.jsx)(t.th,{children:"Format"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"nodeName"}),(0,n.jsx)(t.td,{children:"Node where the test is executed."}),(0,n.jsx)(t.td,{children:"string"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"testIndex"}),(0,n.jsx)(t.td,{children:"Index of the test on the Kubernetes CIS benchmark."}),(0,n.jsx)(t.td,{children:"string"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"status"}),(0,n.jsx)(t.td,{children:"Test results: PASS, FAIL, INFO."}),(0,n.jsx)(t.td,{children:"string"})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"scored"}),(0,n.jsx)(t.td,{children:"Indicates whether the Kubernetes CIS benchmark counts this test towards their scoring."}),(0,n.jsx)(t.td,{children:"string"})]})]})]}),"\n",(0,n.jsx)(t.h3,{id:"all-testscsv",children:"all-tests.csv"}),"\n",(0,n.jsx)(t.p,{children:"A .csv file with tests that were executed on all nodes. Format remains the same as above."})]})}function a(e={}){let{wrapper:t}={...(0,i.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(o,{...e})}):o(e)}},17869:function(e,t,r){r.d(t,{R:()=>d,x:()=>c});var s=r(16645);let n={},i=s.createContext(n);function d(e){let t=s.useContext(i);return s.useMemo(function(){return"function"==typeof e?e(t):{...t,...e}},[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:d(e.components),s.createElement(i.Provider,{value:t},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.