<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-configuration-compliance-scanning
description: >-
  Scan systems for CIS Benchmark compliance, DISA STIG adherence, and custom
  security baselines using OpenSCAP, Nessus compliance audits, and Lynis.
  Covers automated hardening verification and remediation tracking.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - compliance-scanning
  - cis-benchmarks
  - stig
  - openscap
  - lynis
  - hardening
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1082"]
---

# Performing Configuration Compliance Scanning

## Overview

Configuration compliance scanning verifies that systems meet security baselines
(CIS Benchmarks, DISA STIGs, PCI DSS). Unlike vulnerability scanning which finds
software flaws, compliance scanning identifies insecure configurations — weak
permissions, disabled logging, missing hardening controls.

## Prerequisites

| Requirement | Install |
|---|---|
| OpenSCAP | `apt install libopenscap8 scap-security-guide` |
| Lynis | `apt install lynis` or `brew install lynis` |
| Nessus Professional | Compliance audit plugins |
| Python 3.10+ | Agent tooling |
| CIS-CAT Pro | CIS membership required |

## Key Concepts

### OpenSCAP Compliance Scanning

```bash
# List available SCAP profiles
oscap info /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml

# CIS Level 1 server scan
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server \
  --results scan_results.xml \
  --report compliance_report.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml

# DISA STIG scan
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_stig \
  --results stig_results.xml \
  --report stig_report.html \
  /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

# Generate fix script from results
oscap xccdf generate fix \
  --fix-type bash \
  --result-id "" \
  stig_results.xml > remediation.sh

# Scan specific component
oscap oval eval \
  --results oval_results.xml \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-oval.xml
```

### Lynis System Auditing

```bash
# Full system audit
lynis audit system --quick --no-colors > lynis_output.txt

# Compliance-specific scan
lynis audit system --tests-from-group authentication --no-colors

# Pentest profile (more aggressive checks)
lynis audit system --pentest --no-colors

# Generate report data
lynis audit system --report-file /tmp/lynis_report.dat
grep "warning" /tmp/lynis_report.dat
grep "suggestion" /tmp/lynis_report.dat
```

### Nessus Compliance Audits

```bash
# Launch compliance scan via API
curl -sk -X POST \
  -H "X-ApiKeys: accessKey=$NESSUS_ACCESS;secretKey=$NESSUS_SECRET" \
  "https://localhost:8834/scans" \
  -d '{
    "uuid": "'"$COMPLIANCE_TEMPLATE_UUID"'",
    "settings": {
      "name": "CIS Ubuntu 22.04 Compliance",
      "text_targets": "192.168.1.0/24",
      "policy_id": '"$CIS_POLICY_ID"'
    }
  }'

# Export compliance results
curl -sk -H "X-ApiKeys: accessKey=$NESSUS_ACCESS;secretKey=$NESSUS_SECRET" \
  "https://localhost:8834/scans/$SCAN_ID/export" \
  -d 'format=csv&chapters=compliance' -o compliance_results.csv
```

### Common CIS Benchmark Checks

| Control | Check | Fix |
|---|---|---|
| Password length | `grep PASS_MIN_LEN /etc/login.defs` | Set `PASS_MIN_LEN 14` |
| SSH root login | `sshd -T \| grep permitrootlogin` | Set `PermitRootLogin no` |
| Firewall active | `ufw status` or `iptables -L` | `ufw enable` |
| Audit logging | `systemctl is-active auditd` | `systemctl enable auditd` |
| File permissions | `stat -c %a /etc/shadow` | `chmod 640 /etc/shadow` |

## Workflow

1. **Select baseline** — Choose CIS Level, STIG, or custom profile
2. **Scan** — Run OpenSCAP/Lynis against target systems
3. **Analyze** — Review pass/fail/error counts and severity distribution
4. **Remediate** — Generate fix scripts, apply through change management
5. **Rescan** — Verify compliance score improved after remediation
6. **Report** — Generate compliance evidence for auditors

## Detection

```yaml
title: Configuration Compliance Scanning Detection
id: 467d9a48-63c8-432a-a9b7-f2f1a59e149b
status: experimental
description: Detects suspicious activity related to performing configuration compliance scanning techniques in vulnerability management context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*configuration*"
  condition: selection
level: medium
tags:
  - attack.t1082
  - attack.discovery
falsepositives:
  - Vulnerability scanner performing scheduled assessment scans
```

## Verification

| Check | Method |
|---|---|
| SCAP content available | `oscap info <datastream.xml>` lists profiles |
| Scan completed | Results XML contains `<TestResult>` element |
| Report generated | HTML report opens and shows pass/fail table |
| Fix script valid | `bash -n remediation.sh` passes syntax check |
| Score improved | Compliance percentage increased post-remediation |

## References

- [OpenSCAP User Guide](https://www.open-scap.org/resources/documentation/)
- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
- [DISA STIGs](https://public.cyber.mil/stigs/)
- [Lynis Documentation](https://cisofy.com/documentation/lynis/)
