@cyberstrike-io/cyberstrike 1.1.10-beta.5 → 1.1.10

package/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_OKE_Benchmark_v1.7.0/cis-oke-v170-3.1.2/SKILL.md

@@ -17,15 +17,19 @@ severity_boost: {}
 # CIS OKE Benchmark v1.7.0 - Control 3.1.2
 
 ## Profile Applicability
+
 - **Level:** 1
 
 ## Description
+
 If `kubelet` is running, ensure that the file ownership of its kubelet-config.json file is set to `root:root`.
 
 ## Rationale
+
 The kubelet-config.json file for `kubelet` controls various parameters for the `kubelet` service in the worker node. You should set its file ownership to maintain the integrity of the file. The file should be owned by `root:root`.
 
 ## Impact
+
 None
 
 ## Audit Procedure
@@ -69,19 +73,19 @@ metadata:
   name: file-check
 spec:
   volumes:
-  - name: host-root
-    hostPath:
-      path: /
-      type: Directory
-  containers:
-  - name: nsenter
-    image: busybox
-    command: ["sleep", "3600"]
-    volumeMounts:
     - name: host-root
-      mountPath: /host
-    securityContext:
-      privileged: true
+      hostPath:
+        path: /
+        type: Directory
+  containers:
+    - name: nsenter
+      image: busybox
+      command: ["sleep", "3600"]
+      volumeMounts:
+        - name: host-root
+          mountPath: /host
+      securityContext:
+        privileged: true
 ```
 
 Save this to a file (e.g., file-check-pod.yaml) and create the pod:
@@ -105,6 +109,7 @@ ls -l /host/etc/kubernetes/kubelet-config.json
 Verify that the ownership is set to `root:root`.
 
 ## Remediation
+
 Run the below command (based on the file location on your system) on the each worker node. For example,
 
 ```bash
@@ -112,25 +117,28 @@ chown root:root <kubelet-config.json file>
 ```
 
 ## Default Value
+
 See the OKE documentation for the default value.
 
 ## References
+
 1. https://kubernetes.io/docs/admin/kube-proxy/
 2. https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengoverview.htm
 
 ## CIS Controls
 
-| Controls Version | Control | IG 1 | IG 2 | IG 3 |
-|-----------------|---------|------|------|------|
-| v8 | 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts | * | * | * |
-| v7 | 5.2 Maintain Secure Images | | * | * |
-| v6 | 5.1 Minimize And Sparingly Use Administrative Privileges | | | |
+| Controls Version | Control                                                                   | IG 1 | IG 2 | IG 3 |
+| ---------------- | ------------------------------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts | \*   | \*   | \*   |
+| v7               | 5.2 Maintain Secure Images                                                |      | \*   | \*   |
+| v6               | 5.1 Minimize And Sparingly Use Administrative Privileges                  |      |      |      |
 
 ## MITRE ATT&CK Mappings
 
-| Techniques / Sub-techniques | Tactics | Mitigations |
-|-----------------------------|---------|-------------|
-| T1083, T1222 | TA0005, TA0007 | M1026 |
+| Techniques / Sub-techniques | Tactics        | Mitigations |
+| --------------------------- | -------------- | ----------- |
+| T1083, T1222                | TA0005, TA0007 | M1026       |
 
 ## Profile
+
 **Level 1** (Automated)

package/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_OKE_Benchmark_v1.7.0/cis-oke-v170-3.1.3/SKILL.md

@@ -17,15 +17,19 @@ severity_boost: {}
 # CIS OKE Benchmark v1.7.0 - Control 3.1.3
 
 ## Profile Applicability
+
 - **Level:** 1
 
 ## Description
+
 Ensure that if the kubelet refers to a configuration file with the `--config` argument, that file has permissions of 644 or more restrictive.
 
 ## Rationale
+
 The kubelet reads various parameters, including security settings, from a config file specified by the `--config` argument. If this file is specified you should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.
 
 ## Impact
+
 None.
 
 ## Audit Procedure
@@ -69,19 +73,19 @@ metadata:
   name: file-check
 spec:
   volumes:
-  - name: host-root
-    hostPath:
-      path: /
-      type: Directory
-  containers:
-  - name: nsenter
-    image: busybox
-    command: ["sleep", "3600"]
-    volumeMounts:
     - name: host-root
-      mountPath: /host
-    securityContext:
-      privileged: true
+      hostPath:
+        path: /
+        type: Directory
+  containers:
+    - name: nsenter
+      image: busybox
+      command: ["sleep", "3600"]
+      volumeMounts:
+        - name: host-root
+          mountPath: /host
+      securityContext:
+        privileged: true
 ```
 
 Save this to a file (e.g., file-check-pod.yaml) and create the pod:
@@ -105,6 +109,7 @@ ls -l /host/etc/kubernetes/kubelet.conf
 Verify that if a file is specified and it exists, the permissions are `644` or more restrictive.
 
 ## Remediation
+
 Run the following command (using the config file location identified in the Audit step)
 
 ```bash
@@ -112,24 +117,27 @@ chmod 644 etc/kubernetes/kubelet.conf
 ```
 
 ## Default Value
+
 See the OKE documentation for the default value.
 
 ## References
+
 1. https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/
 2. https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengoverview.htm
 
 ## CIS Controls
 
-| Controls Version | Control | IG 1 | IG 2 | IG 3 |
-|-----------------|---------|------|------|------|
-| v8 | 3.3 Configure Data Access Control Lists | * | * | * |
-| v7 | 14.6 Protect Information through Access Control Lists | * | * | * |
+| Controls Version | Control                                               | IG 1 | IG 2 | IG 3 |
+| ---------------- | ----------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 3.3 Configure Data Access Control Lists               | \*   | \*   | \*   |
+| v7               | 14.6 Protect Information through Access Control Lists | \*   | \*   | \*   |
 
 ## MITRE ATT&CK Mappings
 
-| Techniques / Sub-techniques | Tactics | Mitigations |
-|-----------------------------|---------|-------------|
-| T1083, T1222 | TA0005, TA0007 | M1022 |
+| Techniques / Sub-techniques | Tactics        | Mitigations |
+| --------------------------- | -------------- | ----------- |
+| T1083, T1222                | TA0005, TA0007 | M1022       |
 
 ## Profile
+
 **Level 1** (Automated)

package/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_OKE_Benchmark_v1.7.0/cis-oke-v170-3.1.4/SKILL.md

@@ -17,15 +17,19 @@ severity_boost: {}
 # CIS OKE Benchmark v1.7.0 - Control 3.1.4
 
 ## Profile Applicability
+
 - **Level:** 1
 
 ## Description
+
 Ensure that if the kubelet refers to a configuration file with the `--config` argument, that file is owned by root:root.
 
 ## Rationale
+
 The kubelet reads various parameters, including security settings, from a config file specified by the `--config` argument. If this file is specified you should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.
 
 ## Impact
+
 None.
 
 ## Audit Procedure
@@ -69,19 +73,19 @@ metadata:
   name: file-check
 spec:
   volumes:
-  - name: host-root
-    hostPath:
-      path: /
-      type: Directory
-  containers:
-  - name: nsenter
-    image: busybox
-    command: ["sleep", "3600"]
-    volumeMounts:
     - name: host-root
-      mountPath: /host
-    securityContext:
-      privileged: true
+      hostPath:
+        path: /
+        type: Directory
+  containers:
+    - name: nsenter
+      image: busybox
+      command: ["sleep", "3600"]
+      volumeMounts:
+        - name: host-root
+          mountPath: /host
+      securityContext:
+        privileged: true
 ```
 
 Save this to a file (e.g., file-check-pod.yaml) and create the pod:
@@ -105,6 +109,7 @@ ls -l /etc/kubernetes/kubelet.conf
 The output of the above command gives you the file's ownership. Verify that the ownership is set to `root:root`.
 
 ## Remediation
+
 Run the following command (using the config file location identified in the Audit step)
 
 ```bash
@@ -112,23 +117,26 @@ chown root:root /etc/kubernetes/kubelet.conf
 ```
 
 ## Default Value
+
 See the OKE documentation for the default value.
 
 ## References
+
 1. https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/
 2. https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengoverview.htm
 
 ## CIS Controls
 
-| Controls Version | Control | IG 1 | IG 2 | IG 3 |
-|-----------------|---------|------|------|------|
-| v8 | 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts | * | * | * |
+| Controls Version | Control                                                                   | IG 1 | IG 2 | IG 3 |
+| ---------------- | ------------------------------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts | \*   | \*   | \*   |
 
 ## MITRE ATT&CK Mappings
 
-| Techniques / Sub-techniques | Tactics | Mitigations |
-|-----------------------------|---------|-------------|
-| T1083, T1222 | TA0005, TA0007 | M1026 |
+| Techniques / Sub-techniques | Tactics        | Mitigations |
+| --------------------------- | -------------- | ----------- |
+| T1083, T1222                | TA0005, TA0007 | M1026       |
 
 ## Profile
+
 **Level 1** (Automated)

package/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_OKE_Benchmark_v1.7.0/cis-oke-v170-3.2.1/SKILL.md

@@ -17,15 +17,19 @@ severity_boost: {}
 # CIS OKE Benchmark v1.7.0 - Control 3.2.1
 
 ## Profile Applicability
+
 - **Level:** 1
 
 ## Description
+
 Disable anonymous requests to the Kubelet server.
 
 ## Rationale
+
 When enabled, requests that are not rejected by other configured authentication methods are treated as anonymous requests. These requests are then served by the Kubelet server. You should rely on authentication to authorize access and disallow anonymous requests.
 
 ## Impact
+
 Anonymous requests will be rejected.
 
 ## Audit Procedure
@@ -86,7 +90,7 @@ If modifying the Kubelet service config file, edit the kubelet.service file `/et
 
 If using the api configz endpoint consider searching for the status of `"authentication.*anonymous":{"enabled":false}` by extracting the live configuration from the nodes running kubelet.
 
-**See detailed step-by-step configmap procedures in [Reconfigure a Node's Kubelet in a Live Cluster](https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/), and then rerun the curl statement from audit process to check for kubelet configuration changes
+\*\*See detailed step-by-step configmap procedures in [Reconfigure a Node's Kubelet in a Live Cluster](https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/), and then rerun the curl statement from audit process to check for kubelet configuration changes
 
 ```bash
 kubectl proxy --port=8001 &
@@ -106,25 +110,28 @@ systemctl status kubelet -l
 ```
 
 ## Default Value
+
 See the OKE documentation for the default value.
 
 ## References
+
 1. https://kubernetes.io/docs/admin/kubelet/
 2. https://kubernetes.io/docs/admin/kubelet-authentication-authorization/#kubelet-authentication
 3. https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengoverview.htm
 
 ## CIS Controls
 
-| Controls Version | Control | IG 1 | IG 2 | IG 3 |
-|-----------------|---------|------|------|------|
-| v8 | 3.3 Configure Data Access Control Lists | * | * | * |
-| v7 | 14.6 Protect Information through Access Control Lists | * | * | * |
+| Controls Version | Control                                               | IG 1 | IG 2 | IG 3 |
+| ---------------- | ----------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 3.3 Configure Data Access Control Lists               | \*   | \*   | \*   |
+| v7               | 14.6 Protect Information through Access Control Lists | \*   | \*   | \*   |
 
 ## MITRE ATT&CK Mappings
 
-| Techniques / Sub-techniques | Tactics | Mitigations |
-|-----------------------------|---------|-------------|
-| T1190, T1210 | TA0001, TA0008 | M1025 |
+| Techniques / Sub-techniques | Tactics        | Mitigations |
+| --------------------------- | -------------- | ----------- |
+| T1190, T1210                | TA0001, TA0008 | M1025       |
 
 ## Profile
+
 **Level 1** (Automated)

package/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_OKE_Benchmark_v1.7.0/cis-oke-v170-3.2.10/SKILL.md

@@ -17,17 +17,21 @@ severity_boost: {}
 # CIS OKE Benchmark v1.7.0 - Control 3.2.10
 
 ## Profile Applicability
+
 - **Level:** 1
 
 ## Description
+
 Enable kubelet server certificate rotation.
 
 ## Rationale
+
 `--rotate-server-certificates` causes the kubelet to both request a serving certificate after bootstrapping its client credentials and rotate the certificate as its existing credentials expire. This automated periodic rotation ensures that the there are no downtimes due to expired certificates and thus addressing availability in the CIA security triad.
 
 Note: This recommendation only applies if you let kubelets get their certificates from the API server. In case your kubelet certificates come from an outside authority/tool (e.g. Vault) then you need to take care of rotation yourself.
 
 ## Impact
+
 None
 
 ## Audit Procedure
@@ -88,7 +92,7 @@ If modifying the Kubelet service config file, edit the kubelet.service file `/et
 
 If using the api configz endpoint consider searching for the status of `--rotate-server-certificates` by extracting the live configuration from the nodes running kubelet.
 
-**See detailed step-by-step configmap procedures in [Reconfigure a Node's Kubelet in a Live Cluster](https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/), and then rerun the curl statement from audit process to check for kubelet configuration changes
+\*\*See detailed step-by-step configmap procedures in [Reconfigure a Node's Kubelet in a Live Cluster](https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/), and then rerun the curl statement from audit process to check for kubelet configuration changes
 
 ```bash
 kubectl proxy --port=8001 &
@@ -108,9 +112,11 @@ systemctl status kubelet -l
 ```
 
 ## Default Value
+
 See the OKE documentation for the default value.
 
 ## References
+
 1. https://github.com/kubernetes/kubernetes/pull/45059
 2. https://kubernetes.io/docs/admin/kubelet-tls-bootstrapping/#kubelet-configuration
 3. https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengoverview.htm
@@ -118,16 +124,17 @@ See the OKE documentation for the default value.
 
 ## CIS Controls
 
-| Controls Version | Control | IG 1 | IG 2 | IG 3 |
-|-----------------|---------|------|------|------|
-| v8 | 3.10 Encrypt Sensitive Data in Transit | | * | * |
-| v7 | 14.4 Encrypt All Sensitive Information in Transit | | * | * |
+| Controls Version | Control                                           | IG 1 | IG 2 | IG 3 |
+| ---------------- | ------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 3.10 Encrypt Sensitive Data in Transit            |      | \*   | \*   |
+| v7               | 14.4 Encrypt All Sensitive Information in Transit |      | \*   | \*   |
 
 ## MITRE ATT&CK Mappings
 
 | Techniques / Sub-techniques | Tactics | Mitigations |
-|-----------------------------|---------|-------------|
-| T1552 | TA0006 | M1022 |
+| --------------------------- | ------- | ----------- |
+| T1552                       | TA0006  | M1022       |
 
 ## Profile
+
 **Level 1** (Automated)

package/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_OKE_Benchmark_v1.7.0/cis-oke-v170-3.2.2/SKILL.md

@@ -17,15 +17,19 @@ severity_boost: {}
 # CIS OKE Benchmark v1.7.0 - Control 3.2.2
 
 ## Profile Applicability
+
 - **Level:** 1
 
 ## Description
+
 Do not allow all requests. Enable explicit authorization.
 
 ## Rationale
+
 Kubelets, by default, allow all authenticated requests (even anonymous ones) without needing explicit authorization checks from the apiserver. You should restrict this behavior and only allow explicitly authorized requests.
 
 ## Impact
+
 Unauthorized requests will be denied.
 
 ## Audit Procedure
@@ -86,7 +90,7 @@ If modifying the Kubelet service config file, edit the kubelet.service file `/et
 
 If using the api configz endpoint consider searching for the status of `"authentication.*webhook":{"enabled":true}` by extracting the live configuration from the nodes running kubelet.
 
-**See detailed step-by-step configmap procedures in [Reconfigure a Node's Kubelet in a Live Cluster](https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/), and then rerun the curl statement from audit process to check for kubelet configuration changes
+\*\*See detailed step-by-step configmap procedures in [Reconfigure a Node's Kubelet in a Live Cluster](https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/), and then rerun the curl statement from audit process to check for kubelet configuration changes
 
 ```bash
 kubectl proxy --port=8001 &
@@ -106,25 +110,28 @@ systemctl status kubelet -l
 ```
 
 ## Default Value
+
 See the OKE documentation for the default value.
 
 ## References
+
 1. https://kubernetes.io/docs/admin/kubelet/
 2. https://kubernetes.io/docs/admin/kubelet-authentication-authorization/#kubelet-authentication
 3. https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengoverview.htm
 
 ## CIS Controls
 
-| Controls Version | Control | IG 1 | IG 2 | IG 3 |
-|-----------------|---------|------|------|------|
-| v8 | 3.3 Configure Data Access Control Lists | * | * | * |
-| v7 | 9.2 Ensure Only Approved Ports, Protocols and Services Are Running | | * | * |
+| Controls Version | Control                                                            | IG 1 | IG 2 | IG 3 |
+| ---------------- | ------------------------------------------------------------------ | ---- | ---- | ---- |
+| v8               | 3.3 Configure Data Access Control Lists                            | \*   | \*   | \*   |
+| v7               | 9.2 Ensure Only Approved Ports, Protocols and Services Are Running |      | \*   | \*   |
 
 ## MITRE ATT&CK Mappings
 
 | Techniques / Sub-techniques | Tactics | Mitigations |
-|-----------------------------|---------|-------------|
-| T1133 | TA0001 | M1026 |
+| --------------------------- | ------- | ----------- |
+| T1133                       | TA0001  | M1026       |
 
 ## Profile
+
 **Level 1** (Automated)

package/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_OKE_Benchmark_v1.7.0/cis-oke-v170-3.2.3/SKILL.md

@@ -17,15 +17,19 @@ severity_boost: {}
 # CIS OKE Benchmark v1.7.0 - Control 3.2.3
 
 ## Profile Applicability
+
 - **Level:** 1
 
 ## Description
+
 Enable Kubelet authentication using certificates.
 
 ## Rationale
+
 The connections from the apiserver to the kubelet are used for fetching logs for pods, attaching (through kubectl) to running pods, and using the kubelet's port-forwarding functionality. These connections terminate at the kubelet's HTTPS endpoint. By default, the apiserver does not verify the kubelet's serving certificate, which makes the connection subject to man-in-the-middle attacks, and unsafe to run over untrusted and/or public networks. Enabling Kubelet certificate authentication ensures that the apiserver could authenticate the Kubelet before submitting any requests.
 
 ## Impact
+
 You require TLS to be configured on apiserver as well as kubelets.
 
 ## Audit Procedure
@@ -86,7 +90,7 @@ If modifying the Kubelet service config file, edit the kubelet.service file `/et
 
 If using the api configz endpoint consider searching for the status of `"authentication.*x509":{"clientCAFile":"/etc/kubernetes/pki/ca.crt"` by extracting the live configuration from the nodes running kubelet.
 
-**See detailed step-by-step configmap procedures in [Reconfigure a Node's Kubelet in a Live Cluster](https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/), and then rerun the curl statement from audit process to check for kubelet configuration changes
+\*\*See detailed step-by-step configmap procedures in [Reconfigure a Node's Kubelet in a Live Cluster](https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/), and then rerun the curl statement from audit process to check for kubelet configuration changes
 
 ```bash
 kubectl proxy --port=8001 &
@@ -106,25 +110,28 @@ systemctl status kubelet -l
 ```
 
 ## Default Value
+
 See the OKE documentation for the default value.
 
 ## References
+
 1. https://kubernetes.io/docs/admin/kubelet/
 2. https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/
 3. https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengoverview.htm
 
 ## CIS Controls
 
-| Controls Version | Control | IG 1 | IG 2 | IG 3 |
-|-----------------|---------|------|------|------|
-| v8 | 3.10 Encrypt Sensitive Data in Transit | | * | * |
-| v7 | 14.4 Encrypt All Sensitive Information in Transit | | * | * |
+| Controls Version | Control                                           | IG 1 | IG 2 | IG 3 |
+| ---------------- | ------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 3.10 Encrypt Sensitive Data in Transit            |      | \*   | \*   |
+| v7               | 14.4 Encrypt All Sensitive Information in Transit |      | \*   | \*   |
 
 ## MITRE ATT&CK Mappings
 
 | Techniques / Sub-techniques | Tactics | Mitigations |
-|-----------------------------|---------|-------------|
-| T1552 | TA0006 | M1022 |
+| --------------------------- | ------- | ----------- |
+| T1552                       | TA0006  | M1022       |
 
 ## Profile
+
 **Level 1** (Automated)

package/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_OKE_Benchmark_v1.7.0/cis-oke-v170-3.2.4/SKILL.md

@@ -17,15 +17,19 @@ severity_boost: {}
 # CIS OKE Benchmark v1.7.0 - Control 3.2.4
 
 ## Profile Applicability
+
 - **Level:** 1
 
 ## Description
+
 Disable the read-only port.
 
 ## Rationale
+
 The Kubelet process provides a read-only API in addition to the main Kubelet API. Unauthenticated access is provided to this read-only API which could possibly retrieve potentially sensitive information about the cluster.
 
 ## Impact
+
 Removal of the read-only port will require that any service which made use of it will need to be re-configured to use the main Kubelet API.
 
 ## Audit Procedure
@@ -69,23 +73,26 @@ systemctl status kubelet -l
 ```
 
 ## Default Value
+
 See the OKE documentation for the default value.
 
 ## References
+
 1. https://kubernetes.io/docs/admin/kubelet/
 
 ## CIS Controls
 
-| Controls Version | Control | IG 1 | IG 2 | IG 3 |
-|-----------------|---------|------|------|------|
-| v8 | 4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | | * | * |
-| v7 | 9.2 Ensure Only Approved Ports, Protocols and Services Are Running | | * | * |
+| Controls Version | Control                                                                         | IG 1 | IG 2 | IG 3 |
+| ---------------- | ------------------------------------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software |      | \*   | \*   |
+| v7               | 9.2 Ensure Only Approved Ports, Protocols and Services Are Running              |      | \*   | \*   |
 
 ## MITRE ATT&CK Mappings
 
-| Techniques / Sub-techniques | Tactics | Mitigations |
-|-----------------------------|---------|-------------|
-| T1133 | TA0001, TA0003 | M1030, M1035 |
+| Techniques / Sub-techniques | Tactics        | Mitigations  |
+| --------------------------- | -------------- | ------------ |
+| T1133                       | TA0001, TA0003 | M1030, M1035 |
 
 ## Profile
+
 **Level 1** (Automated)

package/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_OKE_Benchmark_v1.7.0/cis-oke-v170-3.2.5/SKILL.md

@@ -17,17 +17,21 @@ severity_boost: {}
 # CIS OKE Benchmark v1.7.0 - Control 3.2.5
 
 ## Profile Applicability
+
 - **Level:** 1
 
 ## Description
+
 Do not disable timeouts on streaming connections.
 
 ## Rationale
+
 Setting idle timeouts ensures that you are protected against Denial-of-Service attacks, inactive connections and running out of ephemeral ports.
 
 **Note:** By default, `--streaming-connection-idle-timeout` is set to 4 hours which might be too high for your environment. Setting this as appropriate would additionally ensure that such streaming connections are timed out after serving legitimate use cases.
 
 ## Impact
+
 Long-lived connections could be interrupted.
 
 ## Audit Procedure
@@ -88,7 +92,7 @@ If modifying the Kubelet service config file, edit the kubelet.service file `/et
 
 If using the api configz endpoint consider searching for the status of `"streamingConnectionIdleTimeout":` by extracting the live configuration from the nodes running kubelet.
 
-**See detailed step-by-step configmap procedures in [Reconfigure a Node's Kubelet in a Live Cluster](https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/), and then rerun the curl statement from audit process to check for kubelet configuration changes
+\*\*See detailed step-by-step configmap procedures in [Reconfigure a Node's Kubelet in a Live Cluster](https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/), and then rerun the curl statement from audit process to check for kubelet configuration changes
 
 ```bash
 kubectl proxy --port=8001 &
@@ -108,25 +112,28 @@ systemctl status kubelet -l
 ```
 
 ## Default Value
+
 See the OKE documentation for the default value.
 
 ## References
+
 1. https://kubernetes.io/docs/admin/kubelet/
 2. https://github.com/kubernetes/kubernetes/pull/18552
 3. https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengoverview.htm
 
 ## CIS Controls
 
-| Controls Version | Control | IG 1 | IG 2 | IG 3 |
-|-----------------|---------|------|------|------|
-| v8 | 10.5 Enable Anti-Exploitation Features | | * | * |
-| v7 | 8.3 Enable Operating System Anti-Exploitation Features / Deploy Anti-Exploit Technologies | | * | * |
+| Controls Version | Control                                                                                   | IG 1 | IG 2 | IG 3 |
+| ---------------- | ----------------------------------------------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 10.5 Enable Anti-Exploitation Features                                                    |      | \*   | \*   |
+| v7               | 8.3 Enable Operating System Anti-Exploitation Features / Deploy Anti-Exploit Technologies |      | \*   | \*   |
 
 ## MITRE ATT&CK Mappings
 
 | Techniques / Sub-techniques | Tactics | Mitigations |
-|-----------------------------|---------|-------------|
-| T1490 | TA0040 | M1028 |
+| --------------------------- | ------- | ----------- |
+| T1490                       | TA0040  | M1028       |
 
 ## Profile
+
 **Level 1** (Automated)