CIS-CAT

[Felipe Andres Concha Sepúlveda]

Hello good afternoon,

I would just like to confirm with you that integration with CIS-CAT can only be done with the CIS-CAT pro version and not with CIS-CAT lite

Do I have to download the CIS-CAT pro in the agent?...as this step is not in the documentation I have this confusion…the documentation only talks about downloading java

 

 

[david.v...@wazuh.com]

Hi Felipe,

Yes, the integration can only be done with CIS-CAT Pro. 

This is because CIS-CAT Lite doesn't have the Command Line Interface (CLI) feature that CIS-CAT Pro has. 

We also give support for some CIS features in our configuration that CIS-CAT Lite doesn't have (https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/wodle-ciscat.html):

- Schedule scans.

- Access to CIS Benchmarks in XCCDF.

You can check the different features in CIS-CAT Pro and CIS-CAT Lite in https://learn.cisecurity.org/cis-cat-landing-page

In order to integrate CIS-CAT with Wazuh it's necessary to download (you must buy it) and install CIS-CAT Pro in the agent. The steps to do that are in the official CIS website (linked in the documentation):

https://www.cisecurity.org/cybersecurity-tools/cis-cat-pro/

Regards,

David

[Felipe Andres Concha Sepúlveda]

Thanks you very much David for the information!!!

Regards,

Felipe

El 13-02-2019, a las 12:09, david.v...@wazuh.com escribió:

Hi Felipe,

Yes, the integration can only be done with CIS-CAT Pro. 

This is because CIS-CAT Lite doesn't have the Command Line Interface (CLI) feature that CIS-CAT Pro has. 

We also give support for some CIS features in our configuration that CIS-CAT doesn't have (https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/wodle-ciscat.html):

- Schedule scans.

- Access to CIS Benchmarks in XCCDF.

You can check the different features in CIS-CAT Pro and CIS-CAT Lite in https://learn.cisecurity.org/cis-cat-landing-page

In order to integrate CIS-CAT with Wazuh it's necessary to download (you must buy it) and install CIS-CAT Pro in the agent. The steps to do that are in the official CIS website (linked in the documentation):

https://www.cisecurity.org/cybersecurity-tools/cis-cat-pro/

Regards,

David

On Tuesday, February 12, 2019 at 5:39:14 PM UTC+1, Felipe Andres Concha Sepúlveda wrote:

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To post to this group, send email to wa...@googlegroups.com.
Visit this group at https://groups.google.com/group/wazuh.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/391aee4e-c479-4f30-9f4b-c6b90c71e75e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Felipe Andres Concha Sepúlveda]

Hello good afternoon,

Because I do not have CIS-CAT pro, can I use Rootcheck functionality downloaded the windows guides from CIS and add them easily?

Are guides already configured?

If possible, could you give me an example of how to do it?

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To post to this group, send email to wa...@googlegroups.com.
Visit this group at https://groups.google.com/group/wazuh.

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/bb9343e3-9572-4bdc-a100-d6dff64bd4b9%40googlegroups.com.

[david.v...@wazuh.com]

Hi again Felipe,

You can use Rootcheck only with the CIS policies that are available for Wazuh (the ones in the website you attached in the last mail). You could add other CIS policies by translating the checks located at CIS benchmarks to a readable format for Wazuh (we already have that in our roadmap: https://github.com/wazuh/wazuh/issues/2629)

The basic configuration you should use is explained in the following link: https://documentation.wazuh.com/3.x/user-manual/capabilities/policy-monitoring/rootcheck/rootcheck-configuration.html

However, we're currently working on a new module called "configuration assessment" (it will be available with v3.9) that will work with some CIS policies (it will have enriched fields with upgraded CIS policies). You can check some of those new files in:

https://github.com/wazuh/wazuh/tree/3.9/etc/configuration-assessment

Regards,

David

On Monday, February 18, 2019 at 6:34:55 PM UTC+1, Felipe Andres Concha Sepúlveda wrote:

Hello good afternoon,

Because I do not have CIS-CAT pro, can I use Rootcheck functionality downloaded the windows guides from CIS and add them easily?

Are guides already configured?

If possible, could you give me an example of how to do it?

El 13-02-2019, a las 12:10, escribió:

Hi Felipe,

Yes, the integration can only be done with CIS-CAT Pro. 

This is because CIS-CAT Lite doesn't have the Command Line Interface (CLI) feature that CIS-CAT Pro has. 

We also give support for some CIS features in our configuration that CIS-CAT Lite doesn't have (https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/wodle-ciscat.html):

- Schedule scans.

- Access to CIS Benchmarks in XCCDF.

You can check the different features in CIS-CAT Pro and CIS-CAT Lite in https://learn.cisecurity.org/cis-cat-landing-page

In order to integrate CIS-CAT with Wazuh it's necessary to download (you must buy it) and install CIS-CAT Pro in the agent. The steps to do that are in the official CIS website (linked in the documentation):

https://www.cisecurity.org/cybersecurity-tools/cis-cat-pro/

Regards,

David

On Tuesday, February 12, 2019 at 5:39:14 PM UTC+1, Felipe Andres Concha Sepúlveda wrote:

Hello good afternoon,

I would just like to confirm with you that integration with CIS-CAT can only be done with the CIS-CAT pro version and not with CIS-CAT lite

Do I have to download the CIS-CAT pro in the agent?...as this step is not in the documentation I have this confusion…the documentation only talks about downloading java

 

 

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.

To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.

[Felipe Andres Concha Sepúlveda]

Thank you very much David for the information !!!

Regards,

Felipe

To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.

To post to this group, send email to wa...@googlegroups.com.
Visit this group at https://groups.google.com/group/wazuh.

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/98f9c579-5d45-4c6e-8823-b9014a87962f%40googlegroups.com.

[Felipe Andres Concha Sepúlveda]

Hello good morning,

According to our last conversation related to the problem of using Openscap in windows, you told me that you were working with Rootcheck, adding more security policies from the CIS benchmarks and working on a new module called configuration assessment that will be available in version 3.9 that will work with some CIS policies.

My question is, is this still in planning, will there be dates for this?

Regards,

Felipe

[david.v...@wazuh.com]

Hi Felipe,

Yes, this new module will be featured in version 3.9 which is in the final steps to be released. I can't tell you a final release date but it should be out in the next few weeks. It'll be announced in the mailing list so please stay tuned.

Best regards,

David

On Thursday, March 21, 2019 at 11:59:57 AM UTC+1, Felipe Andres Concha Sepúlveda wrote:

Hello good morning,

According to our last conversation related to the problem of using Openscap in windows, you told me that you were working with Rootcheck, adding more security policies from the CIS benchmarks and working on a new module called configuration assessment that will be available in version 3.9 that will work with some CIS policies.

My question is, is this still in planning, will there be dates for this?

Regards,

Felipe

El 19-02-2019, a las 14:21, Felipe Andres Concha Sepúlveda <> escribió:

Thank you very much David for the information !!!

Regards,

Felipe

[Felipe Andres Concha Sepúlveda]

Thanks David!!!

To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.

To post to this group, send email to wa...@googlegroups.com.
Visit this group at https://groups.google.com/group/wazuh.

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/61e2fddd-8a66-4cdd-b506-df0dd207a8ec%40googlegroups.com.