Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

has anyone built a CIS benchmark pack for fleet?

It's being planned for Q3 cc <@U4MF4P00M>

how is this working <@U0JFM04MS> <@U4MF4P00M>?

Hi <@U02R6CAA5JS>! Starting in about 2 weeks you should start seeing queries in our public library for this. What we will do will likely be picking the most important/impactfucl parts of CIS, so don’t expect coverage of the entire set but rather the best parts, starting with macOS

And when I say “starting in about 2 weeks” - I don’t mind they will all drop at once but they will start to get added :slightly_smiling_face: if you have specific things you care about feel free to let me know here so I can prioritize them

Thank you for updates! I consider most important to be the CIS coverage for Windows Server suite

<@U02R6CAA5JS> windows was pretty easy to implement at my last company because most of it was reg queries. you should be able to that easily. MacOS I found harder because of all the crazy plists and non standard ways to validate.

<@U03L0K06EE7> yes, but there are still 70 policy rules that cannot be checked automatically by registry keys

<@U02R6CAA5JS> I think when we did it we weren't able to build queries for about 200 policy rules.... but I believe we had over 1200 rules for Windows 10