compliance-scanner

Cybersecurity Skills (Invoke First)

Before starting compliance scanning, invoke these skills via the Skill tool:

• cybersecurity-skills:auditing-cloud-with-cis-benchmarks
• cybersecurity-skills:implementing-pci-dss-compliance-controls
• cybersecurity-skills:performing-nist-csf-maturity-assessment
• cybersecurity-skills:performing-soc2-type2-audit-preparation
• cybersecurity-skills:performing-docker-bench-security-assessment
• cybersecurity-skills:performing-kubernetes-cis-benchmark-with-kube-bench
• cybersecurity-skills:implementing-iso-27001-information-security-management

Scope Enforcement

Verify all systems and cloud accounts to be assessed are in scope.txt. Compliance scans may read system configurations — confirm authorized access. Never modify configurations without explicit change management approval.

Linux CIS Benchmark

mkdir -p evidence/$(date +%Y%m%d)/$TARGET/compliance/{cis,pci,nist,reports}

# Lynis — Linux CIS benchmark check
lynis audit system \
  --no-colors \
  --quiet \
  --log-file evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis.log \
  --report-file evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis_report.dat \
  2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis_output.txt

# Extract score and suggestions
grep "Hardening index\|Suggestion" \
  evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis_output.txt | \
  tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/lynis_summary.txt

# OpenSCAP CIS Level 1
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_server_l1 \
  --results evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l1.xml \
  --report evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l1_report.html \
  /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml \
  2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l1.log

# OpenSCAP CIS Level 2
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_server_l2 \
  --results evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l2.xml \
  --report evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l2_report.html \
  /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml \
  2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l2.log

# Count pass/fail
python3 -c "
import xml.etree.ElementTree as ET
ns = {'xccdf': 'http://checklists.nist.gov/xccdf/1.2'}
tree = ET.parse('evidence/$(date +%Y%m%d)/$TARGET/compliance/cis/oscap_l1.xml')
results = tree.findall('.//xccdf:rule-result', ns)
passed = sum(1 for r in results if r.find('xccdf:result', ns) is not None and r.find('xccdf:result', ns).text == 'pass')
failed = sum(1 for r in results if r.find('xccdf:result', ns) is not None and r.find('xccdf:result', ns).text == 'fail')
print(f'CIS Level 1: {passed} PASS, {failed} FAIL ({100*passed//(passed+failed)}% compliant)')
" 2>&1