KSPM FAQ

Frequently asked questions about the Kubernetes Security Posture Management (KSPM) integration and features.

What versions of Kubernetes are supported?

For self-managed/vanilla clusters, Kubernetes version 1.23 is supported.

For EKS clusters, all Kubernetes versions available at the time of cluster deployment are supported.

Can I evaluate the security posture of my Amazon EKS clusters? Yes. KSPM currently supports the security posture evaluation of Amazon EKS and unmanaged Kubernetes clusters.

How often is my cluster’s security posture evaluated? Clusters are evaluated when you deploy a KSPM integration, and every four hours after that.

When do newly-enrolled clusters appear on the dashboard? It can take up to 10 minutes for deployment, resource fetching, evaluation, and data processing to complete before a newly-enrolled cluster appears on the dashboard.

When do unenrolled clusters disappear from the dashboard? A cluster will disappear as soon as the KSPM integration fetches data while that cluster is not enrolled. The fetch process repeats every four hours, which means a newly unenrolled cluster can take a maximum of four hours to disappear from the dashboard.

Are all the findings page current? Yes. Only the most recent findings appear on the Findings page.

Can I build custom visualizations and dashboards that incorporate findings data? Yes. You can use Kibana’s custom visualization capabilities with findings data. To learn more, refer to Dashboards and visualizations.

Where is Findings data saved? You can access findings data using the following index patterns:

Do benchmark rules support multiple Kubernetes deployment types? Yes. There are different sets of benchmark rules for self-managed and EKS-managed deployments. Refer to Get started with KSPM for more information about setting up each deployment type.

How often are my resources evaluated against benchmark rules? Resources are fetched and evaluated against benchmark rules when a KSPM integration is deployed, and every four hours after that.

Can I configure the KSPM integration’s fetch cycle? No, the four-hour fetch cycle is not configurable.

Can I contribute to the CSP ruleset? You can’t directly edit benchmark rules. The rules are defined in this repository, where you can raise issues with certain rules. They are written in Rego.

How can I tell which specific version of the CIS benchmarks is in use? Refer to the rule.benchmark.name and rule.benchmark.version fields for documents in these datastreams: