mcpField
C
cis-benchmarks

cis-benchmarks

github.com/bagelholeSecurity1.2k370 installsUpdated 23w ago
Repository

About cis-benchmarks

A skill for security and compliance teams to assess, implement, and audit CIS security benchmarks. It demonstrates tools including OpenSCAP, Lynis, InSpec, and kube-bench.

Key features

  1. 01CIS benchmark scanning examples
  2. 02OpenSCAP and Lynis audits
  3. 03Writing InSpec controls
  4. 04Kubernetes benchmark checks
  5. 05Finding remediation workflow
  6. 06Ongoing assessment practices

Use cases

  1. 01Assess system security compliance
  2. 02Establish baselines and harden systems
  3. 03Check Kubernetes nodes and control planes
  4. 04Track benchmark deviations and exceptions

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill cis-benchmarks

After installing, type/cis-benchmarksin Claude Code to confirm it loaded.

Details

From the project README

CIS Benchmarks

Implement and audit CIS security benchmarks.

When to Use This Skill

Use this skill when:

  • Assessing security compliance
  • Implementing security baselines
  • Meeting regulatory requirements
  • Hardening systems to standards

Assessment Tools

OpenSCAP
# Install
apt install openscap-scanner scap-security-guide

# Run CIS benchmark scan
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis \
  --results results.xml \
  --report report.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml
Lynis
# Install
apt install lynis

# Run audit
lynis audit system

# Generate report
lynis audit system --report-file /tmp/lynis-report.dat
InSpec
# cis-profile/controls/ssh.rb
control 'cis-ssh-1' do
  impact 1.0
  title 'Ensure SSH root login is disabled'
  
  describe sshd_config do
    its('PermitRootLogin') { should eq 'no' }
  end
end

control 'cis-ssh-2' do
  impact 0.7
  title 'Ensure SSH password authentication is disabled'
  
  describe sshd_config do
    its('PasswordAuthentication') { should eq 'no' }
  end
end

# Run InSpec
inspec exec cis-profile -t ssh://user@target
Kubernetes CIS
# kube-bench
docker run --rm -v /etc:/etc:ro -v /var:/var:ro \
  aquasec/kube-bench:latest run --targets node

# Check specific sections
kube-bench run --targets master --check 1.1,1.2

Remediation Workflow

workflow:
  1_scan:
    - Run automated assessment
    - Generate baseline report
    
  2_analyze:
    - Review findings
    - Identify false positives
    - Prioritize by risk
    
  3_remediate:
    - Apply fixes
    - Document exceptions
    - Verify changes
    
  4_validate:
    - Re-run assessment
    - Confirm remediation
    - Generate compliance report

Best Practices

  • Baseline before hardening
  • Document exceptions
  • Automate assessments
  • Track compliance over time
  • Regular re-assessment
  • Version control configurations

Related Skills

Comments

Markdown supported