Uploaded image for project: 'Red Hat Advanced Cluster Security'
  1. Red Hat Advanced Cluster Security
  2. ROX-29361

Integrate Third-Party Vulnerability Scanning for Windows Containers (CrowdStrike)

    • Icon: Feature Feature
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • None
    • Vuln Management
    • Product / Portfolio Work
    • False
    • Hide

      None

      Show
      None
    • False
    • ROX-29360Windows Container Security Visibility and Policy Enforcement
    • Not Selected

      As a devops engineer,

      I want Red Hat Advanced Cluster Security (RHACS) to integrate with CrowdStrike as a third-party vulnerability scanner for my Windows container images.

      So that I can leverage CrowdStrike's specialized threat intelligence and vulnerability detection capabilities for my Windows workloads within OpenShift, providing a more comprehensive security assessment.

      Acceptance Criteria:

      • RHACS can be configured to communicate with a designated CrowdStrike instance or API endpoint.
      • When a Windows container image is identified within OpenShift, RHACS can trigger a vulnerability scan of that image using CrowdStrike.
      • RHACS can receive and parse vulnerability scan results from CrowdStrike for Windows container images.
      • Vulnerability findings from CrowdStrike are displayed within the RHACS vulnerability reporting interface, clearly indicating the source of the scan results (CrowdStrike).
      • RHACS can correlate CrowdStrike vulnerability findings with running Windows containers and associated Kubernetes resources.
      • Security policies within RHACS can be defined and enforced based on the severity and specific vulnerabilities reported by CrowdStrike for Windows containers.
      • RHACS policies can be configured to trigger based on vulnerability findings from CrowdStrike in Windows containers, for example, block a deployment if high vulnerabilities exist in the Windows container 
      • The integration with CrowdStrike is configurable and allows for specifying API keys or other necessary authentication credentials.
      • Clear documentation is provided on how to configure and utilize the CrowdStrike integration for Windows container vulnerability scanning within RHACS.

      Notes:

      • This feature focuses explicitly on integrating with CrowdStrike. Integration with other third-party scanners may be considered in future features.
      • The initial integration will focus on retrieving and displaying vulnerability data. 

              sbadve@redhat.com Shubha Badve
              dcaspin@redhat.com Doron Caspin
              Shubha Badve Shubha Badve
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: