Cleaning up policies (#25850)
In support of this issue: fleetdm/confidential#8791
This commit is contained in:
Allen Houchins
@@ -0,0 +1,8 @@
|
||||
- name: Collect operating system information
|
||||
description: "Collects operating system information from all devices enrolled in Fleet"
|
||||
query: SELECT * FROM os_version;
|
||||
interval: 3600 # Every 1 hour
|
||||
observer_can_run: true
|
||||
automations_enabled: true
|
||||
logging: snapshot
|
||||
platform: darwin,linux,windows,chrome
|
||||
+2
-2
@@ -1,6 +1,6 @@
|
||||
- name: Linux - Enable disk encryption
|
||||
- name: Linux - Disk encryption enabled
|
||||
query: SELECT 1 FROM mounts m, disk_encryption d WHERE m.device_alias = d.name AND d.encrypted = 1 AND m.path = '/';
|
||||
critical: false
|
||||
description: This policy checks if disk encryption is enabled.
|
||||
resolution: As an IT admin, deploy an image that includes disk encryption.
|
||||
resolution: Disk encryption can only be configured during initial operating system install. Please re-install your operating system ensuring disk encryption is enabled.
|
||||
platform: linux
|
||||
@@ -0,0 +1,12 @@
|
||||
- name: macOS - No 1Password emergency kit stored in desktop, documents, or downloads folders
|
||||
query: SELECT 1 WHERE
|
||||
NOT EXISTS (
|
||||
SELECT 1 FROM file WHERE
|
||||
filename LIKE '%Emergency Kit%.pdf' AND
|
||||
(path LIKE '/Users/%/Desktop/%' OR path LIKE '/Users/%/Documents/%' OR path LIKE '/Users/%/Downloads/%' OR path LIKE '/Users/Shared/%')
|
||||
);
|
||||
critical: false
|
||||
description: Looks for PDF files with file names typically used by 1Password for emergency recovery kits. To protect the performance of your devices, the search is one level deep and limited to the Desktop, Documents, Downloads, and Shared folders.
|
||||
resolution: Delete 1Password emergency kits from your computer, and empty the trash. 1Password emergency kits should only be printed and stored in a physically secure location.
|
||||
platform: darwin
|
||||
|
||||
@@ -1,105 +0,0 @@
|
||||
- name: CIS - Ensure Auto Update Is Enabled (MDM Required)
|
||||
critical: false
|
||||
platform: darwin
|
||||
description: Checks that the system is configured via MDM to automatically install updates.
|
||||
resolution: "Ask your system administrator to deploy an MDM profile that enables automatic updates."
|
||||
query: |
|
||||
SELECT 1 WHERE
|
||||
EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.SoftwareUpdate' AND
|
||||
name='AutomaticCheckEnabled' AND
|
||||
(value = 1 OR value = 'true') AND
|
||||
username = ''
|
||||
)
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.SoftwareUpdate' AND
|
||||
name='AutomaticCheckEnabled' AND
|
||||
(value != 1 AND value != 'true')
|
||||
);
|
||||
- name: CIS - Ensure Download New Updates When Available Is Enabled (MDM Required)
|
||||
critical: false
|
||||
platform: darwin
|
||||
description: Checks that the system is configured via MDM to automatically download updates.
|
||||
resolution: "Ask your system administrator to deploy an MDM profile that enables automatic update downloads."
|
||||
query: |
|
||||
SELECT 1 WHERE
|
||||
EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.SoftwareUpdate' AND
|
||||
name='AutomaticDownload' AND
|
||||
(value = 1 OR value = 'true') AND
|
||||
username = ''
|
||||
)
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.SoftwareUpdate' AND
|
||||
name='AutomaticDownload' AND
|
||||
(value != 1 AND value != 'true')
|
||||
);
|
||||
- name: CIS - Ensure Install of macOS Updates Is Enabled (MDM Required)
|
||||
critical: false
|
||||
platform: darwin
|
||||
description: Ensure that macOS updates are installed after they are available from Apple.
|
||||
resolution: "Ask your system administrator to deploy an MDM profile that enables automatic install of macOS updates."
|
||||
query: |
|
||||
SELECT 1 WHERE
|
||||
EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.SoftwareUpdate' AND
|
||||
name='AutomaticallyInstallMacOSUpdates' AND
|
||||
(value = 1 OR value = 'true') AND
|
||||
username = ''
|
||||
)
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.SoftwareUpdate' AND
|
||||
name='AutomaticallyInstallMacOSUpdates' AND
|
||||
(value != 1 AND value != 'true')
|
||||
);
|
||||
- name: CIS - Ensure Install Application Updates from the App Store Is Enabled (MDM Required)
|
||||
critical: false
|
||||
platform: darwin
|
||||
description: Ensure that application updates are installed after they are available from Apple.
|
||||
resolution: Ask your system administrator to deploy an MDM profile that enables automatic updates of Apple apps.
|
||||
query: |
|
||||
SELECT 1 WHERE
|
||||
EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.SoftwareUpdate' AND
|
||||
name='AutomaticallyInstallAppUpdates' AND
|
||||
(value = 1 OR value = 'true') AND
|
||||
username = ''
|
||||
)
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.SoftwareUpdate' AND
|
||||
name='AutomaticallyInstallAppUpdates' AND
|
||||
(value != 1 AND value != 'true')
|
||||
);
|
||||
|
||||
- name: CIS - Ensure Install Security Responses and System Files Is Enabled (MDM Required)
|
||||
critical: false
|
||||
platform: darwin
|
||||
description: |
|
||||
Ensure that system and security updates are installed after they are available from
|
||||
Apple. This setting enables definition updates for XProtect and Gatekeeper. With this
|
||||
setting in place, new malware and adware that Apple has added to the list of malware or
|
||||
untrusted software will not execute.
|
||||
resolution: "Ask your system administrator to deploy an MDM profile that enables automatic critical system and security updates."
|
||||
query: |
|
||||
SELECT 1 WHERE
|
||||
EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.SoftwareUpdate' AND
|
||||
name='CriticalUpdateInstall' AND
|
||||
(value = 1 OR value = 'true') AND
|
||||
username = ''
|
||||
)
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.SoftwareUpdate' AND
|
||||
name='CriticalUpdateInstall' AND
|
||||
(value != 1 AND value != 'true')
|
||||
);
|
||||
@@ -1,67 +0,0 @@
|
||||
- name: macOS - Enable FileVault
|
||||
query: SELECT 1 FROM filevault_status WHERE status = 'FileVault is On.';
|
||||
critical: false
|
||||
description: This policy checks if FileVault (disk encryption) is enabled.
|
||||
resolution: As an IT admin, turn on disk encryption in Fleet.
|
||||
platform: darwin
|
||||
- name: macOS - Enable Firewall
|
||||
query: SELECT 1 FROM managed_policies WHERE domain='com.apple.security.firewall' AND username = '' AND name='EnableFirewall' AND CAST(value AS INT) = 1;
|
||||
critical: false
|
||||
description: This policy checks if Firewall is enabled.
|
||||
resolution: An an IT admin, deploy a macOS, Firewall profile with the EnableFirewall option set to true.
|
||||
platform: darwin
|
||||
- name: macOS - Disable guest account
|
||||
query: SELECT 1 FROM plist WHERE path='/Library/Preferences/com.apple.loginwindow.plist' AND key='GuestEnabled' AND value = 0;
|
||||
critical: false
|
||||
description: This policy checks if the guest account is disabled.
|
||||
resolution: An an IT admin, deploy a macOS, login window profile with the DisableGuestAccount option set to true.
|
||||
platform: darwin
|
||||
- name: macOS - Require 10 character password
|
||||
query: SELECT 1 WHERE
|
||||
EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.screensaver' AND
|
||||
name='askForPassword' AND
|
||||
CAST(value AS INT)
|
||||
)
|
||||
AND EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.screensaver' AND
|
||||
name='minLength' AND
|
||||
CAST(value AS INT) <= 10
|
||||
);
|
||||
critical: false
|
||||
description: This policy checks if the end user is required to enter a password, with at least 10 characters, to unlock the host.
|
||||
resolution: An an IT admin, deploy a macOS, screensaver profile with the askForPassword option set to true and minLength option set to 10.
|
||||
platform: darwin
|
||||
- name: macOS - Enable screen saver after 20 minutes
|
||||
query: SELECT 1 WHERE
|
||||
EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.screensaver' AND
|
||||
name='idleTime' AND
|
||||
CAST(value AS INT) <= 1200 AND
|
||||
username = ''
|
||||
)
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM managed_policies WHERE
|
||||
domain='com.apple.screensaver' AND
|
||||
name='idleTime' AND
|
||||
CAST(value AS INT) > 1200
|
||||
);
|
||||
critical: false
|
||||
description: This policy checks if maximum amount of time (in minutes) the device is allowed to sit idle before the screen is locked. End users can select any value less than the specified maximum.
|
||||
resolution: An an IT admin, deploy a macOS, screen saver profile with the maxInactivity option set to 20 minutes.
|
||||
platform: darwin
|
||||
- name: macOS - No 1Password emergency kit stored in desktop, documents, or downloads folders
|
||||
query: SELECT 1 WHERE
|
||||
NOT EXISTS (
|
||||
SELECT 1 FROM file WHERE
|
||||
filename LIKE '%Emergency Kit%.pdf' AND
|
||||
(path LIKE '/Users/%/Desktop/%' OR path LIKE '/Users/%/Documents/%' OR path LIKE '/Users/%/Downloads/%' OR path LIKE '/Users/Shared/%')
|
||||
);
|
||||
critical: false
|
||||
description: Looks for PDF files with file names typically used by 1Password for emergency recovery kits. To protect the performance of your devices, the search is one level deep and limited to the Desktop, Documents, Downloads, and Shared folders.
|
||||
resolution: Delete 1Password emergency kits from your computer, and empty the trash. 1Password emergency kits should only be printed and stored in a physically secure location.
|
||||
platform: darwin
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
- name: macOS - Update Firefox
|
||||
- name: macOS - Firefox up to date
|
||||
query: SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE name = 'Firefox.app') OR EXISTS (SELECT 1 FROM apps WHERE name = 'Firefox.app' AND version_compare(bundle_short_version, '134.0.2') >= 0);
|
||||
critical: false
|
||||
description: The host may have an outdated or non-existent version of Firefox, potentially risking security vulnerabilities or compatibility issues.
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
- name: macOS - Update Slack
|
||||
- name: macOS - Slack up to date
|
||||
query: SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM apps WHERE name = 'Slack.app') OR EXISTS (SELECT 1 FROM apps WHERE name = 'Slack.app' AND version_compare(bundle_short_version, '4.42.116') >= 0);
|
||||
critical: false
|
||||
description: The host may be running an outdated version of Slack, which could pose security vulnerabilities or compatibility issues.
|
||||
|
||||
@@ -1,58 +0,0 @@
|
||||
- name: CIS - Ensure 'Enforce password history' is set to '24' or more passwords
|
||||
critical: false
|
||||
platform: windows
|
||||
description: |
|
||||
This policy check determines the number of renewed, unique passwords that have to be associated with a user account before you can reuse an old password.
|
||||
resolution: |
|
||||
Automatic method:
|
||||
Ask your system administrator to establish the recommended configuration via GP, set the following UI path to 24 or more passwords:
|
||||
'Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Enforce password history'
|
||||
query: |
|
||||
SELECT 1 FROM security_profile_info WHERE password_history_size >= 24;
|
||||
- name: CIS - Ensure 'Maximum password age' is set to '365 or fewer days, but not 0'
|
||||
critical: false
|
||||
platform: windows
|
||||
description: |
|
||||
This policy setting defines how long a user can use their password before it expires.
|
||||
resolution: |
|
||||
Automatic method:
|
||||
Ask your system administrator to establish the recommended configuration via GP, set the following UI path to 365 or fewer days, but not 0:
|
||||
'Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Maximum password age'
|
||||
query: |
|
||||
SELECT 1 FROM security_profile_info WHERE (maximum_password_age <= 365 AND maximum_password_age != 0);
|
||||
- name: CIS - Ensure 'Minimum password age' is set to '1 or more days'
|
||||
critical: false
|
||||
platform: windows
|
||||
description: |
|
||||
This policy setting determines the number of days that you must use a password before you can
|
||||
change it. The range of values for this policy setting is between 1 and 999 days.
|
||||
resolution: |
|
||||
Automatic method:
|
||||
Ask your system administrator to establish the recommended configuration via GP, set the following UI path to 1 or more days:
|
||||
'Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Minimum password age'
|
||||
query: |
|
||||
SELECT 1 FROM security_profile_info WHERE minimum_password_age >= 1;
|
||||
- name: CIS - Ensure 'Minimum password length' is set to '14 or more characters'
|
||||
critical: false
|
||||
platform: windows
|
||||
description: |
|
||||
This policy setting determines the least number of characters that make up a password for a user account.
|
||||
resolution: |
|
||||
Automatic method:
|
||||
Ask your system administrator to establish the recommended configuration via GP, set the following UI path to 14 or more characters
|
||||
'Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Minimum password length'
|
||||
query: |
|
||||
SELECT 1 FROM security_profile_info WHERE minimum_password_length >= 14;
|
||||
- name: CIS - Ensure 'Password must meet complexity requirements' is set to 'Enabled'
|
||||
critical: false
|
||||
platform: windows
|
||||
description: |
|
||||
This policy setting checks all new passwords to ensure that they meet basic requirements for
|
||||
strong passwords. Passwords that contain only alphanumeric characters are extremely easy to
|
||||
discover with several publicly available tools.
|
||||
resolution: |
|
||||
Automatic method:
|
||||
Ask your system administrator to establish the recommended configuration via GP, set the following UI path to 'Enabled':
|
||||
'Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirements'
|
||||
query: |
|
||||
SELECT 1 FROM security_profile_info WHERE password_complexity = 1;
|
||||
@@ -1,31 +0,0 @@
|
||||
- name: Windows - Enable screen saver after 20 minutes
|
||||
query: SELECT 1 FROM mdm_bridge where mdm_command_input = "<SyncBody><Get><CmdID>1</CmdID><Item><Target><LocURI>./Device/Vendor/MSFT/Policy/Result/DeviceLock/MaxInactivityTimeDeviceLock</LocURI></Target></Item></Get></SyncBody>" and CAST(mdm_command_output AS INT) <= 20;
|
||||
critical: false
|
||||
description: This policy checks if maximum amount of time (in minutes) the device is allowed to sit idle before the screen is locked. End users can select any value less than the specified maximum.
|
||||
resolution: "As an IT admin, to deploy a Windows profile with the MaxInactivityTimeDeviceLock option documented here: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-devicelock#maxinactivitytimedevicelock"
|
||||
platform: windows
|
||||
- name: Windows - Enable BitLocker
|
||||
query: SELECT * FROM bitlocker_info WHERE drive_letter='C:' AND protection_status = 1;
|
||||
critical: false
|
||||
description: As an IT admin, turn on disk encryption in Fleet.
|
||||
resolution: Ask your system administrator to turn on disk encryption in Fleet
|
||||
platform: windows
|
||||
- name: Windows - Disable guest account
|
||||
query: SELECT 1 FROM mdm_bridge where mdm_command_input = "<SyncBody><Get><CmdID>1</CmdID><Item><Target><LocURI>./Device/Vendor/MSFT/Policy/Result/LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus</LocURI></Target></Item></Get></SyncBody>" and CAST(mdm_command_output AS INT) = 0;
|
||||
critical: false
|
||||
description: This policy checks if the guest account is disabled. The Guest account allows unauthenticated network users to gain access to the system.
|
||||
resolution: "As an IT admin, deploy a Windows profile with the Accounts_EnableGuestAccountStatus option documented here: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#accounts_enableguestaccountstatus"
|
||||
platform: windows
|
||||
- name: Windows - Require 10 character password
|
||||
query: SELECT 1 FROM mdm_bridge where mdm_command_input = "<SyncBody><Get><CmdID>1</CmdID><Item><Target><LocURI>./Device/Vendor/MSFT/Policy/Result/DeviceLock/DevicePasswordEnabled</LocURI></Target></Item></Get></SyncBody>" and CAST(mdm_command_output AS INT) = 0;
|
||||
critical: false
|
||||
description: This policy checks if the end user is required to enter a password, with at least 10 characters, to unlock the host.
|
||||
resolution: "As an IT admin, deploy a Windows profile with the DevicePasswordEnabled and MinDevicePasswordLength option documented here: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-devicelock"
|
||||
platform: windows
|
||||
- name: Windows - Antivirus healthy
|
||||
query: SELECT 1 from windows_security_center wsc CROSS JOIN windows_security_products wsp WHERE antivirus = 'Good' AND type = 'Antivirus' AND signatures_up_to_date=1;
|
||||
critical: false
|
||||
description: Checks the status of antivirus and signature updates from the Windows Security Center.
|
||||
resolution: "Ensure Windows Defender or your third-party antivirus is running, up to date, and visible in the Windows Security Center."
|
||||
platform: windows
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
- name: Windows - Antivirus signatures up to date
|
||||
query: SELECT 1 from windows_security_center wsc CROSS JOIN windows_security_products wsp WHERE antivirus = 'Good' AND type = 'Antivirus' AND signatures_up_to_date=1;
|
||||
critical: false
|
||||
description: Checks the status of antivirus and signature updates from the Windows Security Center.
|
||||
resolution: "Run all available Windows updates."
|
||||
platform: windows
|
||||
|
||||
@@ -122,12 +122,12 @@ controls:
|
||||
- path: ../lib/windows/scripts/install-bitdefender.ps1
|
||||
- path: ../lib/windows/scripts/enable-ms-defender.ps1
|
||||
policies:
|
||||
- path: ../lib/macos/policies/device-health.yml
|
||||
- path: ../lib/macos/policies/1password-emergency-kit-check.yml
|
||||
- path: ../lib/macos/policies/update-firefox.yml
|
||||
- path: ../lib/macos/policies/update-slack.yml
|
||||
- path: ../lib/macos/policies/latest-macos.yml
|
||||
- path: ../lib/windows/policies/device-health.yml
|
||||
- path: ../lib/linux/policies/linux-device-health.yml
|
||||
- path: ../lib/windows/policies/windows-device-health.yml
|
||||
- path: ../lib/linux/policies/disk-encryption-check.yml
|
||||
queries:
|
||||
- path: ../lib/macos/queries/collect-failed-login-attempts.yml
|
||||
- path: ../lib/all/queries/collect-fleetd-information.yml
|
||||
|
||||
@@ -83,13 +83,11 @@ controls:
|
||||
- path: ../lib/windows/scripts/remove-fleetd.ps1
|
||||
- path: ../lib/windows/scripts/turn-off-mdm.ps1
|
||||
policies:
|
||||
- path: ../lib/macos/policies/device-health.yml
|
||||
- path: ../lib/macos/policies/1password-emergency-kit-check.yml
|
||||
- path: ../lib/macos/policies/update-firefox.yml
|
||||
- path: ../lib/macos/policies/cis.yml
|
||||
- path: ../lib/macos/policies/latest-macos.yml
|
||||
- path: ../lib/windows/policies/device-health.yml
|
||||
- path: ../lib/windows/policies/cis.yml
|
||||
- path: ../lib/linux/policies/linux-device-health.yml
|
||||
- path: ../lib/windows/policies/windows-device-health.yml
|
||||
- path: ../lib/linux/policies/disk-encryption-check.yml
|
||||
queries:
|
||||
- path: ../lib/macos/queries/collect-failed-login-attempts.yml
|
||||
- path: ../lib/all/queries/collect-usb-devices.yml
|
||||
|
||||
Reference in New Issue
Block a user