STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must configure Alert Manger Receivers to notify SA and ISSO of all audit failure events requiring real-time alerts.

DISA Rule

SV-257559r961401_rule

Vulnerability Number

V-257559

Group Title

SRG-APP-000360-CTR-000815

Rule Version

CNTR-OS-000690

Severity

CAT II

CCI(s)

• CCI-001858 - Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.
• CCI-002702 - Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered.

Weight

10

Fix Recommendation

Create an alert notification receiver.

1. From the Administrator perspective on the OpenShift web console, navigate to Administration >> Cluster Settings >> Configuration >> Alertmanager.

2. Select "Create Receiver".

3. Set the name and choose a Receiver Type.

4. Complete the form as per the organizations policy.

5. Click "Create".

Refer to the following documentation for more information:
https://docs.openshift.com/container-platform/4.8/monitoring/managing-alerts.html#sending-notifications-to-external-systems_managing-alerts

Check Contents

Verify the AlertManager config includes a configured receiver.

1. From the Administrator perspective on the OpenShift web console, navigate to Administration >> Cluster Settings >> Configuration >> Alertmanager.

2. View the list of receivers and inspect the configuration.

3. Verify that at least one receiver is configured as either PagerDuty, Webhook, Email, or Slack according to the organizations policy.

If an alert receiver is not configured according to the organizational policy, this is a finding.

Vulnerability Number

V-257559

Documentable

False

Rule Version

CNTR-OS-000690

Severity Override Guidance

Verify the AlertManager config includes a configured receiver.

1. From the Administrator perspective on the OpenShift web console, navigate to Administration >> Cluster Settings >> Configuration >> Alertmanager.

2. View the list of receivers and inspect the configuration.

3. Verify that at least one receiver is configured as either PagerDuty, Webhook, Email, or Slack according to the organizations policy.

If an alert receiver is not configured according to the organizational policy, this is a finding.

Check Content Reference

M

Target Key

5547