<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-endpoint-compliance-assessment
description: >-
  Perform automated compliance assessments on endpoints against security
  baselines including CIS Benchmarks, DISA STIGs, NIST 800-171, and
  organizational security policies. Covers configuration auditing,
  remediation tracking, and compliance reporting.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - compliance
  - cis-benchmark
  - stig
  - audit
  - hardening
  - configuration-management
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1562.001", "T1112"]
  tools: [python3, powershell, auditd, lynis]
---

# Performing Endpoint Compliance Assessment

## Overview

Endpoint compliance assessment validates that systems meet security baselines
and regulatory requirements. Automated checks against CIS Benchmarks, DISA
STIGs, and organizational policies identify configuration drift, missing
patches, disabled security controls, and policy violations. Results feed
risk dashboards and remediation workflows.

## Prerequisites

| Requirement | Purpose |
|---|---|
| CIS Benchmark or STIG | Reference baseline for target OS |
| Admin/root access | Read system configuration |
| Compliance scanning tool | Automated assessment (optional) |
| Remediation tracking | Track findings to closure |

## Workflow

### Step 1: Windows Security Policy Audit

```powershell
# Export current security policy
secedit /export /cfg C:\Temp\secpol.cfg

# Check password policy
Get-ADDefaultDomainPasswordPolicy | Select-Object MinPasswordLength,
  PasswordHistoryCount, MaxPasswordAge, ComplexityEnabled, LockoutThreshold

# Check audit policy
auditpol /get /category:*

# Check Windows Firewall status
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction

# Check BitLocker status
Get-BitLockerVolume | Select-Object MountPoint, ProtectionStatus, EncryptionMethod
```

### Step 2: Linux Security Audit

```bash
# Password policy — pam_pwquality
grep -E "^(minlen|dcredit|ucredit|lcredit|ocredit)" /etc/security/pwquality.conf

# SSH hardening
grep -E "^(PermitRootLogin|PasswordAuthentication|Protocol|MaxAuthTries|X11Forwarding)" /etc/ssh/sshd_config

# File permissions on critical files
stat -c '%a %U %G %n' /etc/passwd /etc/shadow /etc/group /etc/sudoers

# Check for unpatched vulnerabilities
apt list --upgradable 2>/dev/null | grep -i security || \
yum check-update --security 2>/dev/null

# Run Lynis audit
lynis audit system --quick --no-colors 2>/dev/null | tail -30
```

### Step 3: Automated CIS Benchmark Checks

```python
from typing import Any

CIS_CHECKS = {
    "password_min_length": {
        "benchmark": "CIS 1.1.1",
        "description": "Ensure minimum password length is 14+",
        "expected": 14,
    },
    "account_lockout_threshold": {
        "benchmark": "CIS 1.2.1",
        "description": "Ensure account lockout threshold is 5 or fewer",
        "expected": 5,
    },
    "firewall_enabled": {
        "benchmark": "CIS 9.1.1",
        "description": "Ensure Windows Firewall is enabled for all profiles",
        "expected": True,
    },
    "audit_logon_events": {
        "benchmark": "CIS 17.5.1",
        "description": "Ensure Audit Logon is set to Success and Failure",
        "expected": "Success and Failure",
    },
    "bitlocker_enabled": {
        "benchmark": "CIS 18.9.11.1",
        "description": "Ensure BitLocker drive encryption is enabled",
        "expected": True,
    },
}

def run_compliance_check(checks: dict[str, Any],
                         actual_values: dict[str, Any]) -> dict[str, Any]:
    results = []
    passed = 0
    failed = 0
    for check_id, check in checks.items():
        actual = actual_values.get(check_id)
        if actual is None:
            results.append({
                "id": check_id, "benchmark": check["benchmark"],
                "status": "NOT_ASSESSED", "description": check["description"],
            })
            continue
        compliant = actual >= check["expected"] if isinstance(check["expected"], int) else actual == check["expected"]
        status = "PASS" if compliant else "FAIL"
        if compliant:
            passed += 1
        else:
            failed += 1
        results.append({
            "id": check_id, "benchmark": check["benchmark"],
            "status": status, "expected": check["expected"],
            "actual": actual, "description": check["description"],
        })
    return {
        "total": len(results), "passed": passed, "failed": failed,
        "compliance_pct": round(passed / max(passed + failed, 1) * 100, 1),
        "results": results,
    }
```

### Step 4: Generate Compliance Report

```python
def generate_report(assessment: dict[str, Any], hostname: str) -> dict[str, Any]:
    failed = [r for r in assessment["results"] if r["status"] == "FAIL"]
    return {
        "hostname": hostname,
        "compliance_percentage": assessment["compliance_pct"],
        "total_checks": assessment["total"],
        "passed": assessment["passed"],
        "failed": assessment["failed"],
        "critical_findings": [
            {"benchmark": r["benchmark"], "description": r["description"],
             "expected": r["expected"], "actual": r["actual"]}
            for r in failed
        ],
    }
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Security control disabled | Policy audit | Firewall, AV, or audit disabled |
| Configuration drift | Baseline diff | Setting changed from compliant state |
| Missing patches | Patch audit | Security updates not applied |

```yaml
title: Windows Firewall Disabled on Endpoint
id: d0e1f2a3-b456-7890-ijkl-123456789012
status: experimental
description: Detects Windows Firewall being disabled which may indicate defense evasion
logsource:
  category: firewall
  product: windows
detection:
  selection:
    EventID: 2003
    SettingType: "Enable Windows Defender Firewall"
    SettingValue: "No"
  condition: selection
falsepositives:
  - Temporary disabling during troubleshooting
level: high
tags:
  - attack.t1562.001
  - attack.defense_evasion
```

## Verification

- [ ] Windows security policies exported and audited against CIS
- [ ] Linux SSH, PAM, and file permissions validated
- [ ] Firewall enabled on all profiles with deny-inbound default
- [ ] BitLocker / LUKS encryption active on system volumes
- [ ] Audit policies logging success and failure events
- [ ] Compliance report generated with remediation priorities

## References

- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
- [DISA STIGs](https://public.cyber.mil/stigs/)
- [NIST SP 800-171](https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final)

---
v1.0 | Validated: 2026-03-18
