cyberstrikeus CIS 6.2 — Enable vCPU metrics
Profile Applicability
- Level 1
Description
Openshift Virtualization provides metrics that you can use to monitor the consumption of cluster infrastructure resources, including vCPU. In order to use the vCPU metric, the schedstats=enable kernel argument must be applied.
Rationale
Metrics are a fundamental mechanism for understanding if the guest is behaving in an anomolous suspicious manner.
Impact
The kernel option is a prerequisite for using the prometheus metrics for the vCPU usage, without the metrics being reported.
Audit Procedure
Verify if the option is enabled in the kernel command line:
$ cat /proc/cmdline | grep schedstats=enable
Remediation
Enable the kernel option on all workernodes as documented in Chapter 1. Customizing nodes | Red Hat Product Documentation
Default Value
OpenShift enables schedstats by default.The command should returns a string containing schedstats=enable.
References
None listed in the PDF.
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 8.2 Collect Audit Logs | Y | Y | Y |
| v7 | 6.3 Enable Detailed Logging | N | Y | Y |
MITRE ATT&CK Mappings
| Tactic | Technique |
|---|---|
| Discovery | T1082 - System Information Discovery |
| Defense Evasion | T1562.006 - Impair Defenses: Indicator Blocking |
Profile
- Level 1 - OpenShift Virtualization