Skip to content

Commit 878d118

Browse files
chemamartinezchemamartinez
committed
CIS-CAT rules
1 parent 77db487 commit 878d118

File tree

1 file changed

+105
-0
lines changed

1 file changed

+105
-0
lines changed

‎rules/0510-ciscat_rules.xml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
<!--
2+
- CIS-CAT scanner rules
3+
- This program is a free software; you can redistribute it and/or modify it under the terms of GPLv2.
4+
-->
5+
6+
<!-- ID: 87400 - 87500 -->
7+
8+
<!-- Example JSON event
9+
{"type":"scan_result","scan_id":1670424437,"cis-data":{"rule_id":"6.2.20","rule_title":"Ensure shadow group is empty","group":"Additional Process Hardening","description":"The shadow group allows system programs which require access the ability to read the /etc/shadow file. No users should be assigned to the shadow group.","rationale":"Any users assigned to the shadow group would be granted read access to the /etc/shadow file. If attackers can gain read access to the /etc/shadow file, they can easily run a password cracking program against the hashed passwords to break them. Other security information that is stored in the /etc/shadow file (such as expiration) could also be useful to subvert additional user accounts.","remediation":"Remove all users from the shadow group, and change the primary group of any users with shadow as their primary group.","result":"pass"}}
10+
-->
11+
12+
<!-- CIS-CAT rules -->
13+
<group name="ciscat,">
14+
15+
<rule id="87401" level="0">
16+
<decoded_as>json</decoded_as>
17+
<field name="type">\.+</field>
18+
<field name="scan_id">\.+</field>
19+
<description>CIS-CAT events.</description>
20+
</rule>
21+
22+
<rule id="87402" level="3">
23+
<if_sid>87401</if_sid>
24+
<field name="type">^scan_info$</field>
25+
<description>CIS-CAT: assessment information for scan $(scan_id)</description>
26+
</rule>
27+
28+
<rule id="87403" level="0">
29+
<if_sid>87401</if_sid>
30+
<field name="type">^scan_result$</field>
31+
<field name="cis-data.result">^pass$</field>
32+
<description>CIS-CAT: $(cis-data.description) (passed)</description>
33+
</rule>
34+
35+
<rule id="87404" level="0">
36+
<if_sid>87401</if_sid>
37+
<field name="type">^scan_result$</field>
38+
<field name="cis-data.result">^notchecked$</field>
39+
<description>CIS-CAT: $(cis-data.description) (not checked)</description>
40+
</rule>
41+
42+
<rule id="87405" level="0">
43+
<if_sid>87401</if_sid>
44+
<field name="type">^scan_result$</field>
45+
<field name="cis-data.result">^notselected$</field>
46+
<description>CIS-CAT: $(cis-data.description) (not selected)</description>
47+
</rule>
48+
49+
<rule id="87406" level="3">
50+
<if_sid>87401</if_sid>
51+
<field name="type">^scan_result$</field>
52+
<field name="cis-data.result">^error$</field>
53+
<description>CIS-CAT: $(cis-data.description) (error)</description>
54+
</rule>
55+
56+
<rule id="87407" level="3">
57+
<if_sid>87401</if_sid>
58+
<field name="type">^scan_result$</field>
59+
<field name="cis-data.result">^unknown$</field>
60+
<description>CIS-CAT: $(cis-data.description) (unknown)</description>
61+
</rule>
62+
63+
<rule id="87408" level="1">
64+
<if_sid>87401</if_sid>
65+
<field name="type">^scan_result$</field>
66+
<field name="cis-data.result">^informational$</field>
67+
<description>CIS-CAT: $(cis-data.description) (informational)</description>
68+
</rule>
69+
70+
<rule id="87409" level="7">
71+
<if_sid>87401</if_sid>
72+
<field name="type">^scan_result$</field>
73+
<field name="cis-data.result">^fail$</field>
74+
<description>CIS-CAT: $(cis-data.description) (not passed)</description>
75+
</rule>
76+
77+
<!-- Example JSON event
78+
{"type":"scan_info","scan_id":75459013,"cis-data":{"benchmark":"CIS Ubuntu Linux 16.04 LTS Benchmark","hostname":"ubuntu","timestamp":"2017-12-21T03:16:54.431-08:00","score":76}}
79+
-->
80+
81+
<rule id="87410" level="4">
82+
<if_sid>87402</if_sid>
83+
<field name="cis-data.score">^8\d</field>
84+
<description>CIS-CAT Report overview: Score less than 90 % ($(cis-data.score) %)</description>
85+
</rule>
86+
87+
<rule id="87411" level="5">
88+
<if_sid>87402</if_sid>
89+
<field name="cis-data.score">^7\d|^6\d|^5\d</field>
90+
<description>CIS-CAT Report overview: Score less than 80 % ($(cis-data.score) %)</description>
91+
</rule>
92+
93+
<rule id="87412" level="7">
94+
<if_sid>87402</if_sid>
95+
<field name="cis-data.score">^4\d|^3\d</field>
96+
<description>CIS-CAT Report overview: Score less than 50 % ($(cis-data.score) %)</description>
97+
</rule>
98+
99+
<rule id="87413" level="9">
100+
<if_sid>87402</if_sid>
101+
<field name="cis-data.score">^2\d|^1\d|^\d$</field>
102+
<description>CIS-CAT Report overview: Score less than 30 % ($(cis-data.score) %)</description>
103+
</rule>
104+
105+
</group>

0 commit comments

Comments
 (0)