commonfields:
  id: DockerHardeningCheck
  version: -1
name: DockerHardeningCheck
script: ''
type: python
tags:
- Utility
comment: |-
  Checks if the Docker container running this script has been hardened according to the recommended settings at:
  - For Docker hardening guide (Cortex XSOAR 6.13) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Docker-Hardening-Guide
  - For Docker hardening guide (Cortex XSOAR 8 Cloud) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Docker-hardening-guide
  - For Docker hardening guide (Cortex XSOAR 8.7 On-prem) https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Docker-hardening-guide.
enabled: true
args:
- name: memory
  description: The amount of memory to check. Can specify in bytes or append MB/GB for Mega/Giga bytes. Default is 1 GB.
  defaultValue: 1GB
- name: memory_check
  auto: PREDEFINED
  predefined:
  - cgroup
  - allocate
  description: 'The memory check type to perform: cgroup - check memory cgroup configuration, allocate - try allocating actual memory and verify that the allocation fails. Note the allocate test  on some configurations may cause the container to be killed by the linux memory manager and the whole test will then time out.'
  defaultValue: cgroup
- name: pids
  description: The maximum number of PIDs to check.
  defaultValue: '256'
- name: fds_soft
  description: The soft file descriptor limit to check.
  defaultValue: '1024'
- name: fds_hard
  description: The hard file descriptor limit to check.
  defaultValue: '8192'
- name: cpus
  description: The number of CPUs limit to check.
  defaultValue: '1'
- name: network_check
  auto: PREDEFINED
  predefined:
  - cloud_metadata
  - host_machine
  - all
  description: 'The network check to perform. cloud_metadata - check that access is blocked to cloud metadata server, host_machine - check that access is blocked to the host machine on the default gateway IP, all - perform all network tests.'
  defaultValue: cgroup
scripttarget: 0
subtype: python3
dockerimage: demisto/python3:3.12.13.10404775
runas: DBotWeakRole
fromversion: 5.0.0
tests:
- No tests (auto formatted)