elastic / elastic/cloudbeat

Add CIS benchmarks Severity

Open
#1,505 1 comment 2 reactions 0 assignees View on GitHub
cloudbeat Team:Cloud Security
Dominant language
Go
Stars
58
Forks
55
Avg merge
9h 9m
Merged PRs (30d)
424

Description

### Motivation

In the [Alerts](https://github.com/elastic/security-team/issues/4165) Epic we are introducing severity for CIS benchmark rules, the severity is initially planned to be used to create a Detection Rule.

The severity mapping for each rule was added [here](https://docs.google.com/spreadsheets/d/1x5pvZpcwMIjNuKy9tioa7y5gS5lRVWCTnIAOPJNrZnY/edit#gid=2104526417) by @tinnytintin10, and I think it's a good candidate to be added on this repository.

### Definition of done

What needs to be completed at the end of this task

- [ ] All benchmarks rules listed [here](https://docs.google.com/spreadsheets/d/1x5pvZpcwMIjNuKy9tioa7y5gS5lRVWCTnIAOPJNrZnY/edit#gid=2104526417) will have their severity fields in the respective `data.yml` file
- [ ] The severity will also be added to the [integrations](https://github.com/elastic/integrations/tree/main/packages/cloud_security_posture/kibana/csp_rule_template) repository to be consumed by Kibana.
- [ ] Update the csp rule assets based on the updated rules `data.yml` (use the script)

### Out of scope

Default severity for rules not listed in the [Spreadsheet](https://docs.google.com/spreadsheets/d/1x5pvZpcwMIjNuKy9tioa7y5gS5lRVWCTnIAOPJNrZnY/edit#gid=2104526417) .

### Related tasks/epics

- https://github.com/elastic/security-team/issues/4165

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.