<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-cis-benchmark-automation
description: >-
  Automate CIS Benchmark assessments for Linux, Windows, AWS, Azure, GCP, and
  Kubernetes. Implement hardening controls with InSpec profiles, OpenSCAP, and
  OPA policies for continuous benchmark compliance scoring.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - cis-benchmarks
  - hardening
  - openscap
  - inspec
  - compliance
  - automation
  - audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1082"]
---

# Implementing CIS Benchmark Automation

## Overview

CIS Benchmarks provide prescriptive hardening guidance for operating systems, cloud
platforms, and applications. This skill automates benchmark assessment using InSpec,
OpenSCAP, and Prowler, with remediation scripts for automated hardening.

Mode: `[MODE: BLUE]` — Hardening assessment and remediation.

## Prerequisites

| Requirement | Details |
|---|---|
| InSpec (`gem install inspec`) | Required |
| OpenSCAP (`apt install openscap-scanner`) | Required |
| Prowler (`pip install prowler`) | Required |
| `oscap` CLI for SCAP content | Required |

## Key Concepts

### CIS Benchmark Categories

```
CIS Benchmarks — Key Platforms:
├── Operating Systems
│   ├── CIS Ubuntu Linux 22.04 LTS (v2.0) — ~350 controls
│   ├── CIS Red Hat Enterprise Linux 9 — ~300 controls
│   ├── CIS Windows Server 2022 — ~400 controls
│   └── CIS macOS Ventura — ~200 controls
├── Cloud Providers
│   ├── CIS AWS Foundations v3.0 — ~60 controls
│   ├── CIS Azure Foundations v2.1 — ~90 controls
│   └── CIS GCP Foundations v3.0 — ~70 controls
├── Containers & Orchestration
│   ├── CIS Kubernetes v1.9 — ~120 controls
│   └── CIS Docker v1.6 — ~100 controls
└── Databases
    ├── CIS PostgreSQL 16 — ~80 controls
    └── CIS MySQL 8.0 — ~70 controls

Profiles:
├── Level 1: Essential hardening, minimal impact on functionality
└── Level 2: Defense-in-depth, may reduce functionality
```

### OpenSCAP Assessment

```bash
# Download CIS SCAP content
wget https://example.com/cis-ubuntu2204-scap.xml

# Run OpenSCAP assessment
oscap xccdf eval --profile cis_level1_server \
  --results /tmp/scap-results.xml \
  --report /tmp/scap-report.html \
  cis-ubuntu2204-scap.xml

# Generate fix scripts
oscap xccdf generate fix --profile cis_level1_server \
  --fix-type bash \
  cis-ubuntu2204-scap.xml > /tmp/cis-remediate.sh
```

### InSpec Profile — CIS AWS Foundations

```ruby
# controls/cis_aws_foundations.rb
control 'cis-aws-1.4' do
  impact 1.0
  title '1.4 — Ensure no root account access key exists'
  desc 'Remove root account access keys to prevent programmatic root access.'
  tag cis: '1.4'
  tag cis_level: 1

  describe aws_iam_root_user do
    it { should_not have_access_key }
  end
end

control 'cis-aws-1.5' do
  impact 1.0
  title '1.5 — Ensure MFA is enabled for root account'
  tag cis: '1.5'
  tag cis_level: 1

  describe aws_iam_root_user do
    its('has_mfa_enabled') { should be true }
  end
end

control 'cis-aws-2.1.1' do
  impact 1.0
  title '2.1.1 — Ensure S3 bucket default encryption is enabled'
  tag cis: '2.1.1'
  tag cis_level: 1

  aws_s3_buckets.bucket_names.each do |bucket|
    describe aws_s3_bucket(bucket) do
      it { should have_default_encryption_enabled }
    end
  end
end

control 'cis-aws-3.1' do
  impact 1.0
  title '3.1 — Ensure CloudTrail is enabled in all regions'
  tag cis: '3.1'
  tag cis_level: 1

  describe aws_cloudtrail_trails do
    it { should exist }
  end

  aws_cloudtrail_trails.trail_arns.each do |trail|
    describe aws_cloudtrail_trail(trail) do
      it { should be_multi_region_trail }
      it { should be_logging }
    end
  end
end
```

### Prowler CIS Scan

```bash
# AWS CIS Foundations v3.0
prowler aws --compliance cis_3.0 --output-formats json-ocsf csv

# Azure CIS Foundations
prowler azure --compliance cis_2.1 --output-formats json-ocsf

# GCP CIS Foundations
prowler gcp --compliance cis_3.0 --output-formats json-ocsf
```

## Workflow

### Step 1: Select Benchmark and Profile

```bash
node scripts/agent.js --action scan --benchmark cis-aws-3.0 \
  --level 1 --output /tmp/cis-scan.json
```

### Step 2: Generate Remediation Plan

```bash
node scripts/agent.js --action remediate --input /tmp/cis-scan.json \
  --output /tmp/cis-remediation.json
```

### Step 3: Score Compliance

```bash
node scripts/agent.js --action score --input /tmp/cis-scan.json \
  --output /tmp/cis-score.json
```

## Detection

```yaml
title: Cis Benchmark Automation Detection
id: 748a75b1-3e57-44fc-b734-0f13c53eb51b
status: experimental
description: Detects suspicious activity related to implementing cis benchmark automation techniques in compliance audit context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*cis*"
  condition: selection
level: medium
tags:
  - attack.t1082
  - attack.discovery
falsepositives:
  - Compliance scanning tools performing scheduled configuration audits
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cis Benchmark Automation Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1082 |

## Verification

- [ ] CIS Benchmark version identified for each platform
- [ ] Level 1 controls passing at ≥95% compliance score
- [ ] Level 2 controls assessed with risk acceptance for exceptions
- [ ] Automated scanning runs on schedule (daily/weekly)
- [ ] Remediation scripts tested before production deployment
- [ ] Exceptions documented with compensating controls

## References

- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
- [CIS Controls v8](https://www.cisecurity.org/controls)
- [OpenSCAP](https://www.open-scap.org/)
