
title: Ensure the notification is enabled for file integrity operator

platform: not aarch64_arch and not ocp4-on-hypershift

description: |-
  The OpenShift platform provides the File Integrity Operator to monitor for unwanted
  file changes, and this control ensures proper notification alert is enabled so that system
  administrators and security personnel are notified about the alerts

rationale: |-
  File Integrity Operator is able to send out alerts

severity: medium

identifiers:
  cce@ocp4: CCE-90572-9

references:
  nist: SI-6,SI-7(2),SI-4(24)
  pcidss: Req-11.5.1,Req-12.10.5


{{% set jqfilter = '[.items[] | select(.metadata.name =="file-integrity") | .metadata.name]' %}}

ocil_clause: 'A prometheus rule object is not generated by File Integrity Operator'

ocil: |-
    Run the following command to see if alert monitor is enabled by File Integrity Operator:
    <pre>$  oc get prometheusrules --all-namespaces -o json | jq '{{{ jqfilter }}}'</pre>
    Make sure that there is one output named: file-integrity

warnings:
- general: |-
    {{{ openshift_filtered_cluster_setting({'/apis/monitoring.coreos.com/v1/prometheusrules': jqfilter}) | indent(4) }}}

template:
  name: yamlfile_value
  vars:
    ocp_data: "true"
    filepath: |-
      {{{ openshift_filtered_path('/apis/monitoring.coreos.com/v1/prometheusrules', jqfilter) }}}
    yamlpath: "[:]"
    check_existence: "at_least_one_exists"
    entity_check: "at least one"
    values:
      - value: ".*"
        operation: "pattern match"
