From e0cbc3aad7371968d2c0ad0af6b3980cac53bc51 Mon Sep 17 00:00:00 2001 From: Lucas Manuel Rodriguez Date: Fri, 3 Mar 2023 16:11:04 -0300 Subject: [PATCH] Add automation for win-10 cis policies and fix yaml (#10289) --- ee/cis/win-10/cis-policy-queries.yml | 4 ++-- pkg/spec/spec_test.go | 9 +++++++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/ee/cis/win-10/cis-policy-queries.yml b/ee/cis/win-10/cis-policy-queries.yml index ed2ad684b2..d2c0913344 100644 --- a/ee/cis/win-10/cis-policy-queries.yml +++ b/ee/cis/win-10/cis-policy-queries.yml @@ -1203,7 +1203,7 @@ spec: Administrators: Remote Access: Allow: 'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Restrict clients allowed to make remote calls to SAM' query: | -SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\RestrictRemoteSAM' and (data == '' or data == 'O:BAG:BAD:')); + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\RestrictRemoteSAM' and (data == '' or data == 'O:BAG:BAD:')); purpose: Informational tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.10.10 contributors: rachelelysia @@ -1247,7 +1247,7 @@ spec: local users authenticate as themselves: 'Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Sharing and security model for local accounts' query: | - SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\forceguest' AND data == 0); + SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\forceguest' AND data == 0); purpose: Informational tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_2.3.10.12 contributors: rachelelysia diff --git a/pkg/spec/spec_test.go b/pkg/spec/spec_test.go index 1aaf0fa6cd..59a8eb06fe 100644 --- a/pkg/spec/spec_test.go +++ b/pkg/spec/spec_test.go @@ -60,3 +60,12 @@ func TestGroupFromBytesWithMacOS13CISQueries(t *testing.T) { require.NoError(t, err) require.NotEmpty(t, g.Policies) } + +func TestGroupFromBytesWithWin10CISQueries(t *testing.T) { + cisQueries := loadSpec(t, + "ee", "cis", "win-10", "cis-policy-queries.yml", + ) + g, err := GroupFromBytes(cisQueries) + require.NoError(t, err) + require.NotEmpty(t, g.Policies) +}