cis-benchmarks
This skill automates CIS benchmark auditing across Linux and Kubernetes environments using industry-standard tools. Run security assessments, identify compliance gaps, and track remediation through a structured workflow that includes scanning, analysis, fixes, and validation.
CIS Benchmarks audits systems against security standards using automated tools like OpenSCAP, Lynis, and InSpec to generate compliance reports.
AI-generated summary based on this skill's SKILL.md
Install
BagelHole/DevOps-Security-Agent-Skills/cis-benchmarks · repository language: Shell
git clone https://github.com/BagelHole/DevOps-Security-Agent-Skills
cp -r DevOps-Security-Agent-Skills/security/hardening/cis-benchmarks ~/.claude/skills/cis-benchmarksnpx skillfed install BagelHole/DevOps-Security-Agent-Skills/cis-benchmarksFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I run a CIS compliance scan with cis-benchmarks?
cis-benchmarks automates CIS compliance scanning across Linux and Kubernetes systems. The skill executes industry-standard assessment tools to identify security gaps against CIS benchmarks, generates detailed compliance reports, and tracks violations. You can initiate scans through the structured workflow, which handles scanning, analysis, and documentation of findings automatically.
What does cis-benchmarks do for system hardening?
cis-benchmarks hardens systems to meet regulatory and security baseline standards by implementing CIS benchmark controls. The skill not only audits your infrastructure against CIS security profiles but also remediates violations automatically. It applies hardening recommendations across Linux and Kubernetes environments, ensuring systems conform to industry security baselines.
Can cis-benchmarks assess Kubernetes and Linux compliance?
Yes, cis-benchmarks evaluates both Kubernetes and Linux environments against CIS security profiles. The skill performs comprehensive compliance assessments on these platforms, identifies deviations from CIS benchmarks, and supports remediation workflows. It integrates with standard tools to deliver detailed security posture analysis for containerized and traditional Linux systems.
How does cis-benchmarks track security compliance over time?
cis-benchmarks enables continuous compliance validation through re-assessment capabilities. The skill tracks compliance status across multiple scans, documents remediation progress, and maintains audit trails of security changes. This ongoing monitoring helps validate that systems remain aligned with CIS security standards and regulatory requirements.
What remediation does cis-benchmarks provide for violations?
cis-benchmarks implements automated remediation for CIS benchmark violations identified during audits. The skill applies fixes based on CIS hardening recommendations, validates corrections through follow-up assessments, and generates compliance reports showing remediation status. This end-to-end approach reduces manual effort in achieving and maintaining security baselines.
Does cis-benchmarks generate compliance reports?
cis-benchmarks generates comprehensive compliance reports documenting audit findings, violations, and remediation actions. The skill produces structured reports that detail security gaps against CIS benchmarks, track remediation progress, and support regulatory compliance documentation. Reports enable stakeholders to understand security posture and compliance status across audited systems.
SKILL.md
rendered from the published skill — quoted content, verbatim
CIS Benchmarks
Implement and audit CIS security benchmarks.
When to Use This Skill
Use this skill when: - Assessing security compliance - Implementing security baselines - Meeting regulatory requirements - Hardening systems to standards
Assessment Tools
OpenSCAP
# Install
apt install openscap-scanner scap-security-guide
# Run CIS benchmark scan
oscap xccdf eval \
--profile xccdf_org.ssgproject.content_profile_cis \
--results results.xml \
--report report.html \
/usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml
Lynis
# Install
apt install lynis
# Run audit
lynis audit system
# Generate report
lynis audit system --report-file /tmp/lynis-report.dat
InSpec
```ruby
cis-profile/controls/ssh.rb
control 'cis-ssh-1' do impact 1.0 title 'Ensure SSH root login is disabled'
describe sshd_config do
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
security/hardening/cis-benchmarks/SKILL.md