cough c

Question

< spookerlabs> cough cough cis benchmark

spookerlabs · Answer

But CIS check not based on osquery right Just took quick look and seems it uses openscap

stefanmaerz · Answer

yeah for me the value propisition would be that I don t have to maintain yet another tool instead use osquery which helps us kill two birds with one stone openSCAP has all sorts of support for compliance profiles like CIS

8p8c · Answer

it s not based on osquery or openscap afaik from my understanding of cis benchmarks checking some of the file contents wouldn t be possible with osquery

stefanmaerz · Answer

could augeas be used to parse out the content

8p8c · Answer

yes it can in some cases but what if you will hit a file what you don t have a lens for have you tried writing an augeas lens

8p8c · Answer

in some cases it s better to check if a configuration is active rather than what s written in a file

xstevens · Answer

this is a topic I m interested in as well