<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# CIS Benchmark Automation — API Reference

## OpenSCAP CLI

```bash
# Evaluate CIS benchmark
oscap xccdf eval --profile cis_level1_server \
  --results results.xml --report report.html content.xml

# Generate bash remediation script
oscap xccdf generate fix --profile cis_level1_server \
  --fix-type bash content.xml > remediate.sh

# Generate Ansible remediation
oscap xccdf generate fix --profile cis_level1_server \
  --fix-type ansible content.xml > remediate.yml

# List available profiles
oscap info content.xml
```

## Prowler CIS Scans

```bash
# AWS CIS v3.0
prowler aws --compliance cis_3.0 --output-formats json-ocsf csv

# Azure CIS v2.1
prowler azure --compliance cis_2.1 --output-formats json-ocsf

# GCP CIS v3.0
prowler gcp --compliance cis_3.0 --output-formats json-ocsf

# Filter by severity
prowler aws --compliance cis_3.0 --severity critical high
```

## InSpec CIS Resources

```bash
# Run CIS profile
inspec exec cis-aws-profile -t aws:// --reporter json

# Run specific CIS control
inspec exec cis-profile --controls cis-aws-1.4 cis-aws-1.5

# Supermarket CIS profiles
inspec supermarket profiles --search cis
```

## Benchmark Control Counts

| Benchmark | Level 1 | Level 2 | Total |
|-----------|---------|---------|-------|
| CIS Ubuntu 22.04 | ~220 | ~130 | ~350 |
| CIS RHEL 9 | ~190 | ~110 | ~300 |
| CIS AWS v3.0 | ~45 | ~15 | ~60 |
| CIS Kubernetes v1.9 | ~80 | ~40 | ~120 |
| CIS Docker v1.6 | ~65 | ~35 | ~100 |

## Hardening Script Examples

```bash
# CIS 5.2.4 — Ensure SSH MaxAuthTries is set to 3
sed -i 's/^#*MaxAuthTries.*/MaxAuthTries 3/' /etc/ssh/sshd_config

# CIS 1.4.1 — Ensure permissions on bootloader config
chmod 600 /boot/grub/grub.cfg

# CIS 5.4.1.1 — Ensure password expiration is 365 days or less
sed -i 's/^PASS_MAX_DAYS.*/PASS_MAX_DAYS 365/' /etc/login.defs
```
