How do I install the Cis Ocp V170 1.2.21 skill?

Run npx skillmds@latest add cyberstrikeus/cis-ocp-v170-1-2-21 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis Ocp V170 1.2.21 skill do?

Ensure that the audit logs are forwarded off the cluster for retention (Manual) It is listed under DevOps & Infra on SkillMD.

Is Cis Ocp V170 1.2.21 safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis Ocp V170 1.2.21?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis Ocp V170 1.2.21 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis Ocp V170 1.2.21?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis Ocp V170 1.2.21 by cyberstrikeus

Name: Cis Ocp V170 1.2.21
Author: cyberstrikeus

File contents

CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 - Control 1.2.21

Profile Applicability

Level: 1

Description

Retain the logs for at least 30 days or as appropriate.

Rationale

Retaining logs for at least 30 days ensures that you can go back in time and investigate or correlate any events. Set your audit log retention period to 30 days or as per your business requirements.

Impact

None.

Audit Procedure

OpenShift audit works at the API server level, logging all requests coming to the server. Audit is on by default. Best practice is to ship audit logs off the cluster for retention. OpenShift includes the optional Cluster Logging operator and the elasticsearch operator. OpenShift cluster logging can be configured to send logs to destinations outside of your OpenShift Container Platform cluster instead of the default elasticsearch log store using the following methods:

Sending logs using the fluentd forward protocol. You can create a ConfigMap to use the fluentdForward protocol to securely send logs to an external logging aggregator that accepts the fluentdForward protocol.
Sending logs using syslog. You can create a ConfigMap to use the syslog protocol to send logs to an external syslog (RFC 3164) server.

Alternatively, you can use the Log Forwarding API, currently in Technology Preview. The Log Forwarding API, which is easier to configure than the fluentdForward protocol and syslog, exposes configuration for sending logs to the internal elasticsearch log store and to external fluentd log aggregation solutions. You cannot use the ConfigMap methods and the Log Forwarding API in the same cluster.

Verify that audit log forwarding is configured as appropriate.

Remediation

Follow the documentation for log forwarding. Forwarding logs to third party systems.

Default Value

By default, auditing is enabled.

References

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	8.1 Establish and Maintain an Audit Log Management Process	*	*	*
v7	6.4 Ensure adequate storage for logs		*	*

MITRE ATT&CK Mappings

Techniques / Sub-techniques	Tactics	Mitigations
T1543	TA0003, TA0004	M1047

Profile

Level 1 (Manual)

---name: cis-ocp-v170-1-2-21description: Ensure that the audit logs are forwarded off the cluster for retention (Manual)---# CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 - Control 1.2.21## Profile Applicability- **Level:** 1## DescriptionRetain the logs for at least 30 days or as appropriate.## RationaleRetaining logs for at least 30 days ensures that you can go back in time and investigate or correlate any events. Set your audit log retention period to 30 days or as per your business requirements.## ImpactNone.## Audit ProcedureOpenShift audit works at the API server level, logging all requests coming to the server. Audit is on by default. Best practice is to ship audit logs off the cluster for retention. OpenShift includes the optional Cluster Logging operator and the `elasticsearch` operator. OpenShift cluster logging can be configured to send logs to destinations outside of your OpenShift Container Platform cluster instead of the default `elasticsearch` log store using the following methods:- Sending logs using the `fluentd` forward protocol. You can create a `ConfigMap` to use the `fluentdForward` protocol to securely send logs to an external logging aggregator that accepts the `fluentdForward` protocol.- Sending logs using syslog. You can create a `ConfigMap` to use the syslog protocol to send logs to an external syslog (RFC 3164) server.Alternatively, you can use the Log Forwarding API, currently in Technology Preview. The Log Forwarding API, which is easier to configure than the `fluentdForward` protocol and syslog, exposes configuration for sending logs to the internal `elasticsearch` log store and to external `fluentd` log aggregation solutions. You cannot use the `ConfigMap` methods and the Log Forwarding API in the same cluster.Verify that audit log forwarding is configured as appropriate.## RemediationFollow the documentation for log forwarding. Forwarding logs to third party systems.## Default ValueBy default, auditing is enabled.## References1. https://access.redhat.com/solutions/42622012. https://docs.openshift.com/container-platform/latest/logging/cluster-logging-external.html3. https://docs.openshift.com/container-platform/latest/security/audit-log-view.html4. https://github.com/openshift/cluster-kube-apiserver-operator/blob/release-4.5/bindata/v4.1.0/config/defaultconfig.yaml#L41-L775. https://docs.openshift.com/container-platform/4.5/operators/operator-reference.html#kube-apiserver-operator_red-hat-operators6. https://docs.openshift.com/container-platform/4.5/operators/operator-reference.html#openshift-apiserver-operator_red-hat-operators7. https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/8. https://kubernetes.io/docs/tasks/debug-application-cluster/audit/9. https://github.com/kubernetes/features/issues/22## CIS Controls| Controls Version | Control | IG 1 | IG 2 | IG 3 || ---------------- | ---------------------------------------------------------- | ---- | ---- | ---- || v8 | 8.1 Establish and Maintain an Audit Log Management Process | \* | \* | \* || v7 | 6.4 Ensure adequate storage for logs | | \* | \* |## MITRE ATT&CK Mappings| Techniques / Sub-techniques | Tactics | Mitigations || --------------------------- | -------------- | ----------- || T1543 | TA0003, TA0004 | M1047 |## Profile**Level 1** (Manual)

Frequently asked questions

Cis Ocp V170 1.2.21