<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Implementing Ransomware Insurance Readiness — API Reference

## Lynis Security Audit

```bash
# Full system audit
lynis audit system

# Quick audit
lynis audit system --quick

# Check specific test group
lynis audit system --tests-from-group "authentication"
```

## osquery Compliance Queries

```sql
-- Check disk encryption
SELECT * FROM disk_encryption;

-- Check firewall status
SELECT * FROM iptables WHERE chain = 'INPUT';

-- Check running security services
SELECT name, status FROM services
WHERE name LIKE '%falcon%' OR name LIKE '%sentinel%' OR name LIKE '%auditd%';

-- Check SSH configuration
SELECT * FROM ssh_configs WHERE key IN ('PasswordAuthentication', 'PermitRootLogin');
```

## OpenSCAP Compliance

```bash
# Evaluate against CIS benchmark
oscap xccdf eval --profile cis \
  --results results.xml --report report.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml
```

## AWS S3 Backup Immutability

```bash
# Enable Object Lock on bucket
aws s3api put-object-lock-configuration --bucket <BUCKET> \
  --object-lock-configuration \
  '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Days":30}}}'

# Verify Object Lock status
aws s3api get-object-lock-configuration --bucket <BUCKET>
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `requirement` | Insurance requirement ID | `mfa_remote_access` |
| `profile` | SCAP compliance profile | `cis`, `stig` |
| `report_format` | Output format | `json`, `html`, `pdf` |
| `retention_days` | Backup immutability period | `30` |
