[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADVZMP9VBN08GZZXJS2XX4":3,"skill-same:01M6ADVZMP9VBN08GZZXJS2XX4":140},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":48,"linkOnly":49,"markdownContent":50,"markdownBody":51,"frontMatter":52,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":74,"repositoryHtmlUrl":75,"repositoryHomepageUrl":76,"ownerHtmlUrl":77,"ownerBlogUrl":78,"ownerDescription":79,"updatedAt":80,"install":81,"resources":94},"01M6ADVZMP9VBN08GZZXJS2XX4","auditing-cloud-with-cis-benchmarks",null,"Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-cloud-with-cis-benchmarks\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47],"auditing cloud with cis benchmarks","cloud","cloud security","security-hardening","prowler","compliance-assessment","cloud-audit","cis-benchmarks","aws","cloud-security","compliance","security","monitoring","audit","benchmark","assessment","pr","azure","cybersecurity","2026-11-10 10:12:30",false,"---\nname: auditing-cloud-with-cis-benchmarks\ndescription: Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring.\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cis-benchmarks\n- cloud-audit\n- compliance-assessment\n- prowler\n- security-hardening\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- GOVERN-1.1\n- GOVERN-4.2\n- MAP-2.3\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1098.003\n- T1685.002\n- T1580\n---\n\n# Auditing Cloud with CIS Benchmarks\n\n## When to Use\n\n- When performing initial security audits of cloud environments against industry-standard benchmarks\n- When preparing for SOC 2, ISO 27001, or regulatory audits that reference CIS controls\n- When establishing a measurable security baseline for new cloud accounts or subscriptions\n- When tracking compliance improvement over time with periodic reassessment\n- When evaluating the security posture of acquired or inherited cloud environments\n\n**Do not use** for runtime threat detection (see detecting-cloud-threats-with-guardduty), for application-level security testing (see conducting-cloud-penetration-testing), or for compliance frameworks not based on CIS (refer to specific regulatory skill files).\n\n## Prerequisites\n\n- Read-only access to target cloud accounts (AWS SecurityAudit policy, Azure Reader role, GCP Viewer role)\n- Prowler, ScoutSuite, or cloud-native CSPM tools installed and configured\n- Understanding of CIS benchmark structure: sections, controls, profiles (Level 1 and Level 2)\n- Remediation access for implementing fixes (separate from audit credentials)\n\n## Workflow\n\n### Step 1: Select Appropriate CIS Benchmark Version\n\nChoose the correct benchmark version for each cloud provider. Current versions as of 2025 include CIS AWS Foundations Benchmark v5.0, CIS Azure Foundations Benchmark v4.0, and CIS GCP Foundations Benchmark v4.0.\n\n```\nCIS Benchmark Coverage Areas:\n+-------------------+-------------------------+------------------------+\n| Section           | AWS v5.0                | Azure v4.0             |\n+-------------------+-------------------------+------------------------+\n| Identity & Access | IAM policies, MFA, root | Azure AD, RBAC, PIM    |\n| Logging           | CloudTrail, Config      | Activity Log, Diag     |\n| Monitoring        | CloudWatch alarms       | Defender, Sentinel     |\n| Networking        | VPC, SG, NACLs         | NSG, ASG, Firewall     |\n| Storage           | S3 encryption, access   | Storage encryption     |\n| Database          | RDS encryption          | SQL TDE, auditing      |\n+-------------------+-------------------------+------------------------+\n\nCIS Profile Levels:\n  Level 1: Practical security settings that can be implemented without significant\n           performance impact or reduced functionality\n  Level 2: Defense-in-depth settings that may reduce functionality or require\n           additional planning for implementation\n```\n\n### Step 2: Run Automated Assessment with Prowler\n\nExecute comprehensive CIS benchmark scans using Prowler for automated control evaluation across AWS, Azure, and GCP.\n\n```bash\n# AWS CIS v5.0 assessment\nprowler aws \\\n  --compliance cis_5.0_aws \\\n  --profile audit-account \\\n  --output-formats json-ocsf,html,csv \\\n  --output-directory .\u002Fcis-audit-$(date +%Y%m%d)\n\n# Azure CIS v4.0 assessment\nprowler azure \\\n  --compliance cis_4.0_azure \\\n  --subscription-ids \"sub-id-1,sub-id-2\" \\\n  --output-formats json-ocsf,html,csv \\\n  --output-directory .\u002Fcis-audit-azure-$(date +%Y%m%d)\n\n# GCP CIS v4.0 assessment\nprowler gcp \\\n  --compliance cis_4.0_gcp \\\n  --project-ids \"project-1,project-2\" \\\n  --output-formats json-ocsf,html,csv \\\n  --output-directory .\u002Fcis-audit-gcp-$(date +%Y%m%d)\n\n# Multi-account AWS scan using ScoutSuite\nscout suite aws \\\n  --profile audit-account \\\n  --report-dir .\u002Fscout-report \\\n  --ruleset cis-5.0 \\\n  --force\n```\n\n### Step 3: Interpret Results and Prioritize Remediation\n\nAnalyze audit results by section and severity. Prioritize Level 1 controls first as they represent fundamental security hygiene, then address Level 2 controls for defense in depth.\n\n```bash\n# Parse Prowler results for failed controls\ncat .\u002Fcis-audit-*\u002Fprowler-output-*.json | \\\n  jq '[.[] | select(.StatusExtended == \"FAIL\")] | group_by(.CheckID) |\n  map({control: .[0].CheckID, description: .[0].CheckTitle,\n  failed_resources: length, severity: .[0].Severity}) |\n  sort_by(-.failed_resources)'\n\n# Generate compliance score by section\ncat .\u002Fcis-audit-*\u002Fprowler-output-*.json | \\\n  jq 'group_by(.Section) | map({\n    section: .[0].Section,\n    total: length,\n    passed: [.[] | select(.StatusExtended == \"PASS\")] | length,\n    failed: [.[] | select(.StatusExtended == \"FAIL\")] | length,\n    score: (([.[] | select(.StatusExtended == \"PASS\")] | length) \u002F length * 100 | round)\n  })'\n```\n\n### Step 4: Remediate Critical and High Controls\n\nAddress failed controls starting with the highest impact items. Use AWS Config remediation, Azure Policy, or Terraform to apply fixes systematically.\n\n```bash\n# CIS 1.4: Ensure no root account access key exists\naws iam list-access-keys --user-name root\n# If keys exist, delete them\naws iam delete-access-key --user-name root --access-key-id AKIAEXAMPLE\n\n# CIS 2.1.1: Ensure S3 bucket default encryption is enabled\nfor bucket in $(aws s3api list-buckets --query 'Buckets[*].Name' --output text); do\n  aws s3api put-bucket-encryption --bucket \"$bucket\" \\\n    --server-side-encryption-configuration '{\n      \"Rules\": [{\"ApplyServerSideEncryptionByDefault\": {\"SSEAlgorithm\": \"AES256\"}}]\n    }' 2>\u002Fdev\u002Fnull && echo \"Encrypted: $bucket\" || echo \"FAILED: $bucket\"\ndone\n\n# CIS 3.1: Ensure CloudTrail is enabled in all regions\naws cloudtrail create-trail \\\n  --name organization-trail \\\n  --s3-bucket-name cloudtrail-logs-bucket \\\n  --is-multi-region-trail \\\n  --enable-log-file-validation \\\n  --kms-key-id arn:aws:kms:us-east-1:123456789012:key\u002Fkey-id\n\naws cloudtrail start-logging --name organization-trail\n\n# CIS 4.x: Configure CloudWatch metric filters and alarms\naws logs put-metric-filter \\\n  --log-group-name CloudTrail\u002FDefaultLogGroup \\\n  --filter-name UnauthorizedAPICalls \\\n  --filter-pattern '{ ($.errorCode = \"*UnauthorizedAccess*\") || ($.errorCode = \"AccessDenied*\") }' \\\n  --metric-transformations metricName=UnauthorizedAPICalls,metricNamespace=CISBenchmark,metricValue=1\n```\n\n### Step 5: Establish Continuous Compliance Monitoring\n\nDeploy automated compliance monitoring to detect configuration drift between periodic audits. Use AWS Security Hub, Azure Policy, or GCP Security Command Center.\n\n```bash\n# AWS: Enable CIS v5.0 in Security Hub\naws securityhub batch-enable-standards \\\n  --standards-subscription-requests '[\n    {\"StandardsArn\": \"arn:aws:securityhub:::ruleset\u002Fcis-aws-foundations-benchmark\u002Fv\u002F5.0.0\"}\n  ]'\n\n# Azure: Assign CIS benchmark policy initiative\naz policy assignment create \\\n  --name cis-azure-benchmark \\\n  --scope \"\u002Fsubscriptions\u002F\u003Csub-id>\" \\\n  --policy-set-definition \"1a5bb27d-173f-493e-9568-eb56638dbd0e\" \\\n  --params '{\"effect\": {\"value\": \"AuditIfNotExists\"}}'\n\n# Schedule periodic Prowler assessments\n# Run weekly via cron or CI\u002FCD pipeline\n0 2 * * 1 prowler aws --compliance cis_5.0_aws --output-formats csv --output-directory \u002Fopt\u002Faudits\u002Fweekly-$(date +\\%Y\\%m\\%d)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| CIS Benchmark | Prescriptive security configuration guidelines developed by the Center for Internet Security through community consensus |\n| Level 1 Profile | Practical security controls implementable without significant performance or functionality impact, representing security hygiene |\n| Level 2 Profile | Defense-in-depth controls that may restrict functionality and require careful planning before implementation |\n| Foundations Benchmark | CIS benchmark specifically for cloud providers covering IAM, logging, monitoring, networking, and storage security |\n| Control ID | Unique numerical identifier for each CIS recommendation (e.g., 1.4 for root access key checks, 2.1.1 for S3 encryption) |\n| Compliance Score | Percentage of CIS controls in a passing state, tracked over time to measure security posture improvement |\n| Automated Assessment | Tool-driven evaluation of CIS controls using cloud provider APIs to check resource configurations against benchmark requirements |\n| Remediation Runbook | Documented step-by-step procedure for fixing a specific failed CIS control, including pre-checks and validation |\n\n## Tools & Systems\n\n- **Prowler**: Open-source cloud security tool performing 300+ checks including CIS benchmark assessments for AWS, Azure, and GCP\n- **ScoutSuite**: Multi-cloud security auditing tool with CIS benchmark rule sets generating HTML reports\n- **AWS Security Hub**: Native AWS service supporting CIS AWS Foundations Benchmark as a security standard\n- **Azure Policy**: Governance service with built-in CIS benchmark policy initiatives for automated compliance monitoring\n- **GCP Security Command Center**: Native GCP service evaluating configurations against CIS GCP Foundations Benchmark\n\n## Common Scenarios\n\n### Scenario: Pre-Audit CIS Assessment for SOC 2 Certification\n\n**Context**: A SaaS company pursuing SOC 2 Type II certification needs to demonstrate cloud security controls aligned to CIS benchmarks. The auditor requires evidence of continuous compliance monitoring across 45 AWS accounts.\n\n**Approach**:\n1. Run Prowler CIS v5.0 assessment across all 45 accounts to establish the baseline compliance score\n2. Export results to CSV and categorize failures by section (IAM, Logging, Monitoring, Networking)\n3. Map each CIS control to the relevant SOC 2 Trust Services Criteria (CC6.1, CC6.6, CC7.1, etc.)\n4. Remediate all Level 1 control failures within 30 days and Level 2 within 60 days\n5. Enable CIS v5.0 in AWS Security Hub for continuous monitoring and automated drift detection\n6. Generate weekly compliance reports showing improvement trajectory for the auditor\n7. Document exceptions for controls intentionally not implemented with risk acceptance justification\n\n**Pitfalls**: Remediating controls without testing in a staging environment first can break production workloads. Ignoring Level 2 controls entirely weakens the audit narrative even if they are not strictly required.\n\n## Output Format\n\n```\nCIS Benchmark Audit Report\n============================\nCloud Provider: AWS\nBenchmark Version: CIS AWS Foundations Benchmark v5.0\nAccounts Assessed: 45\nAssessment Date: 2025-02-23\nTool: Prowler v4.3.0\n\nOVERALL COMPLIANCE SCORE: 74%\n\nCOMPLIANCE BY SECTION:\n  1. Identity and Access Management:  68% (41\u002F60 controls passed)\n  2. Storage:                         82% (28\u002F34 controls passed)\n  3. Logging:                         91% (20\u002F22 controls passed)\n  4. Monitoring:                      55% (18\u002F33 controls passed)\n  5. Networking:                      78% (32\u002F41 controls passed)\n\nTOP FAILED CONTROLS (by affected accounts):\n  [1.4]   Root account has active access keys           - 3\u002F45 accounts\n  [1.5]   MFA not enabled for root account              - 2\u002F45 accounts\n  [2.1.1] S3 default encryption not enabled             - 12\u002F45 accounts\n  [3.1]   CloudTrail not multi-region                   - 8\u002F45 accounts\n  [4.3]   No alarm for root account usage               - 28\u002F45 accounts\n  [5.1]   VPC flow logs not enabled                     - 15\u002F45 accounts\n  [5.4]   Security groups allow 0.0.0.0\u002F0 ingress      - 22\u002F45 accounts\n\nREMEDIATION PRIORITY:\n  Critical (Fix within 7 days):  Root access keys, missing root MFA\n  High (Fix within 30 days):     S3 encryption, CloudTrail, VPC flow logs\n  Medium (Fix within 60 days):   CloudWatch alarms, security group restrictions\n  Low (Fix within 90 days):      Level 2 controls, informational items\n```\n","# Auditing Cloud with CIS Benchmarks\n\n## When to Use\n\n- When performing initial security audits of cloud environments against industry-standard benchmarks\n- When preparing for SOC 2, ISO 27001, or regulatory audits that reference CIS controls\n- When establishing a measurable security baseline for new cloud accounts or subscriptions\n- When tracking compliance improvement over time with periodic reassessment\n- When evaluating the security posture of acquired or inherited cloud environments\n\n**Do not use** for runtime threat detection (see detecting-cloud-threats-with-guardduty), for application-level security testing (see conducting-cloud-penetration-testing), or for compliance frameworks not based on CIS (refer to specific regulatory skill files).\n\n## Prerequisites\n\n- Read-only access to target cloud accounts (AWS SecurityAudit policy, Azure Reader role, GCP Viewer role)\n- Prowler, ScoutSuite, or cloud-native CSPM tools installed and configured\n- Understanding of CIS benchmark structure: sections, controls, profiles (Level 1 and Level 2)\n- Remediation access for implementing fixes (separate from audit credentials)\n\n## Workflow\n\n### Step 1: Select Appropriate CIS Benchmark Version\n\nChoose the correct benchmark version for each cloud provider. Current versions as of 2025 include CIS AWS Foundations Benchmark v5.0, CIS Azure Foundations Benchmark v4.0, and CIS GCP Foundations Benchmark v4.0.\n\n```\nCIS Benchmark Coverage Areas:\n+-------------------+-------------------------+------------------------+\n| Section           | AWS v5.0                | Azure v4.0             |\n+-------------------+-------------------------+------------------------+\n| Identity & Access | IAM policies, MFA, root | Azure AD, RBAC, PIM    |\n| Logging           | CloudTrail, Config      | Activity Log, Diag     |\n| Monitoring        | CloudWatch alarms       | Defender, Sentinel     |\n| Networking        | VPC, SG, NACLs         | NSG, ASG, Firewall     |\n| Storage           | S3 encryption, access   | Storage encryption     |\n| Database          | RDS encryption          | SQL TDE, auditing      |\n+-------------------+-------------------------+------------------------+\n\nCIS Profile Levels:\n  Level 1: Practical security settings that can be implemented without significant\n           performance impact or reduced functionality\n  Level 2: Defense-in-depth settings that may reduce functionality or require\n           additional planning for implementation\n```\n\n### Step 2: Run Automated Assessment with Prowler\n\nExecute comprehensive CIS benchmark scans using Prowler for automated control evaluation across AWS, Azure, and GCP.\n\n```bash\n# AWS CIS v5.0 assessment\nprowler aws \\\n  --compliance cis_5.0_aws \\\n  --profile audit-account \\\n  --output-formats json-ocsf,html,csv \\\n  --output-directory .\u002Fcis-audit-$(date +%Y%m%d)\n\n# Azure CIS v4.0 assessment\nprowler azure \\\n  --compliance cis_4.0_azure \\\n  --subscription-ids \"sub-id-1,sub-id-2\" \\\n  --output-formats json-ocsf,html,csv \\\n  --output-directory .\u002Fcis-audit-azure-$(date +%Y%m%d)\n\n# GCP CIS v4.0 assessment\nprowler gcp \\\n  --compliance cis_4.0_gcp \\\n  --project-ids \"project-1,project-2\" \\\n  --output-formats json-ocsf,html,csv \\\n  --output-directory .\u002Fcis-audit-gcp-$(date +%Y%m%d)\n\n# Multi-account AWS scan using ScoutSuite\nscout suite aws \\\n  --profile audit-account \\\n  --report-dir .\u002Fscout-report \\\n  --ruleset cis-5.0 \\\n  --force\n```\n\n### Step 3: Interpret Results and Prioritize Remediation\n\nAnalyze audit results by section and severity. Prioritize Level 1 controls first as they represent fundamental security hygiene, then address Level 2 controls for defense in depth.\n\n```bash\n# Parse Prowler results for failed controls\ncat .\u002Fcis-audit-*\u002Fprowler-output-*.json | \\\n  jq '[.[] | select(.StatusExtended == \"FAIL\")] | group_by(.CheckID) |\n  map({control: .[0].CheckID, description: .[0].CheckTitle,\n  failed_resources: length, severity: .[0].Severity}) |\n  sort_by(-.failed_resources)'\n\n# Generate compliance score by section\ncat .\u002Fcis-audit-*\u002Fprowler-output-*.json | \\\n  jq 'group_by(.Section) | map({\n    section: .[0].Section,\n    total: length,\n    passed: [.[] | select(.StatusExtended == \"PASS\")] | length,\n    failed: [.[] | select(.StatusExtended == \"FAIL\")] | length,\n    score: (([.[] | select(.StatusExtended == \"PASS\")] | length) \u002F length * 100 | round)\n  })'\n```\n\n### Step 4: Remediate Critical and High Controls\n\nAddress failed controls starting with the highest impact items. Use AWS Config remediation, Azure Policy, or Terraform to apply fixes systematically.\n\n```bash\n# CIS 1.4: Ensure no root account access key exists\naws iam list-access-keys --user-name root\n# If keys exist, delete them\naws iam delete-access-key --user-name root --access-key-id AKIAEXAMPLE\n\n# CIS 2.1.1: Ensure S3 bucket default encryption is enabled\nfor bucket in $(aws s3api list-buckets --query 'Buckets[*].Name' --output text); do\n  aws s3api put-bucket-encryption --bucket \"$bucket\" \\\n    --server-side-encryption-configuration '{\n      \"Rules\": [{\"ApplyServerSideEncryptionByDefault\": {\"SSEAlgorithm\": \"AES256\"}}]\n    }' 2>\u002Fdev\u002Fnull && echo \"Encrypted: $bucket\" || echo \"FAILED: $bucket\"\ndone\n\n# CIS 3.1: Ensure CloudTrail is enabled in all regions\naws cloudtrail create-trail \\\n  --name organization-trail \\\n  --s3-bucket-name cloudtrail-logs-bucket \\\n  --is-multi-region-trail \\\n  --enable-log-file-validation \\\n  --kms-key-id arn:aws:kms:us-east-1:123456789012:key\u002Fkey-id\n\naws cloudtrail start-logging --name organization-trail\n\n# CIS 4.x: Configure CloudWatch metric filters and alarms\naws logs put-metric-filter \\\n  --log-group-name CloudTrail\u002FDefaultLogGroup \\\n  --filter-name UnauthorizedAPICalls \\\n  --filter-pattern '{ ($.errorCode = \"*UnauthorizedAccess*\") || ($.errorCode = \"AccessDenied*\") }' \\\n  --metric-transformations metricName=UnauthorizedAPICalls,metricNamespace=CISBenchmark,metricValue=1\n```\n\n### Step 5: Establish Continuous Compliance Monitoring\n\nDeploy automated compliance monitoring to detect configuration drift between periodic audits. Use AWS Security Hub, Azure Policy, or GCP Security Command Center.\n\n```bash\n# AWS: Enable CIS v5.0 in Security Hub\naws securityhub batch-enable-standards \\\n  --standards-subscription-requests '[\n    {\"StandardsArn\": \"arn:aws:securityhub:::ruleset\u002Fcis-aws-foundations-benchmark\u002Fv\u002F5.0.0\"}\n  ]'\n\n# Azure: Assign CIS benchmark policy initiative\naz policy assignment create \\\n  --name cis-azure-benchmark \\\n  --scope \"\u002Fsubscriptions\u002F\u003Csub-id>\" \\\n  --policy-set-definition \"1a5bb27d-173f-493e-9568-eb56638dbd0e\" \\\n  --params '{\"effect\": {\"value\": \"AuditIfNotExists\"}}'\n\n# Schedule periodic Prowler assessments\n# Run weekly via cron or CI\u002FCD pipeline\n0 2 * * 1 prowler aws --compliance cis_5.0_aws --output-formats csv --output-directory \u002Fopt\u002Faudits\u002Fweekly-$(date +\\%Y\\%m\\%d)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| CIS Benchmark | Prescriptive security configuration guidelines developed by the Center for Internet Security through community consensus |\n| Level 1 Profile | Practical security controls implementable without significant performance or functionality impact, representing security hygiene |\n| Level 2 Profile | Defense-in-depth controls that may restrict functionality and require careful planning before implementation |\n| Foundations Benchmark | CIS benchmark specifically for cloud providers covering IAM, logging, monitoring, networking, and storage security |\n| Control ID | Unique numerical identifier for each CIS recommendation (e.g., 1.4 for root access key checks, 2.1.1 for S3 encryption) |\n| Compliance Score | Percentage of CIS controls in a passing state, tracked over time to measure security posture improvement |\n| Automated Assessment | Tool-driven evaluation of CIS controls using cloud provider APIs to check resource configurations against benchmark requirements |\n| Remediation Runbook | Documented step-by-step procedure for fixing a specific failed CIS control, including pre-checks and validation |\n\n## Tools & Systems\n\n- **Prowler**: Open-source cloud security tool performing 300+ checks including CIS benchmark assessments for AWS, Azure, and GCP\n- **ScoutSuite**: Multi-cloud security auditing tool with CIS benchmark rule sets generating HTML reports\n- **AWS Security Hub**: Native AWS service supporting CIS AWS Foundations Benchmark as a security standard\n- **Azure Policy**: Governance service with built-in CIS benchmark policy initiatives for automated compliance monitoring\n- **GCP Security Command Center**: Native GCP service evaluating configurations against CIS GCP Foundations Benchmark\n\n## Common Scenarios\n\n### Scenario: Pre-Audit CIS Assessment for SOC 2 Certification\n\n**Context**: A SaaS company pursuing SOC 2 Type II certification needs to demonstrate cloud security controls aligned to CIS benchmarks. The auditor requires evidence of continuous compliance monitoring across 45 AWS accounts.\n\n**Approach**:\n1. Run Prowler CIS v5.0 assessment across all 45 accounts to establish the baseline compliance score\n2. Export results to CSV and categorize failures by section (IAM, Logging, Monitoring, Networking)\n3. Map each CIS control to the relevant SOC 2 Trust Services Criteria (CC6.1, CC6.6, CC7.1, etc.)\n4. Remediate all Level 1 control failures within 30 days and Level 2 within 60 days\n5. Enable CIS v5.0 in AWS Security Hub for continuous monitoring and automated drift detection\n6. Generate weekly compliance reports showing improvement trajectory for the auditor\n7. Document exceptions for controls intentionally not implemented with risk acceptance justification\n\n**Pitfalls**: Remediating controls without testing in a staging environment first can break production workloads. Ignoring Level 2 controls entirely weakens the audit narrative even if they are not strictly required.\n\n## Output Format\n\n```\nCIS Benchmark Audit Report\n============================\nCloud Provider: AWS\nBenchmark Version: CIS AWS Foundations Benchmark v5.0\nAccounts Assessed: 45\nAssessment Date: 2025-02-23\nTool: Prowler v4.3.0\n\nOVERALL COMPLIANCE SCORE: 74%\n\nCOMPLIANCE BY SECTION:\n  1. Identity and Access Management:  68% (41\u002F60 controls passed)\n  2. Storage:                         82% (28\u002F34 controls passed)\n  3. Logging:                         91% (20\u002F22 controls passed)\n  4. Monitoring:                      55% (18\u002F33 controls passed)\n  5. Networking:                      78% (32\u002F41 controls passed)\n\nTOP FAILED CONTROLS (by affected accounts):\n  [1.4]   Root account has active access keys           - 3\u002F45 accounts\n  [1.5]   MFA not enabled for root account              - 2\u002F45 accounts\n  [2.1.1] S3 default encryption not enabled             - 12\u002F45 accounts\n  [3.1]   CloudTrail not multi-region                   - 8\u002F45 accounts\n  [4.3]   No alarm for root account usage               - 28\u002F45 accounts\n  [5.1]   VPC flow logs not enabled                     - 15\u002F45 accounts\n  [5.4]   Security groups allow 0.0.0.0\u002F0 ingress      - 22\u002F45 accounts\n\nREMEDIATION PRIORITY:\n  Critical (Fix within 7 days):  Root access keys, missing root MFA\n  High (Fix within 30 days):     S3 encryption, CloudTrail, VPC flow logs\n  Medium (Fix within 60 days):   CloudWatch alarms, security group restrictions\n  Low (Fix within 90 days):      Level 2 controls, informational items\n```\n",{"name":5,"tags":53,"author":54,"domain":47,"license":15,"version":55,"nist_csf":56,"subdomain":38,"description":7,"nist_ai_rmf":61,"mitre_attack":65},[36,35,34,33,32],"mahipal","1.0.0",[57,58,59,60],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01",[62,63,64],"GOVERN-1.1","GOVERN-4.2","MAP-2.3",[66,67,68,69,70],"T1078.004","T1530","T1098.003","T1685.002","T1580","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fauditing-cloud-with-cis-benchmarks",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":82,"prompt":92,"zipAvailable":93},[83,86,89],{"tool":84,"command":85},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill auditing-cloud-with-cis-benchmarks",{"tool":87,"command":88},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill auditing-cloud-with-cis-benchmarks",{"tool":90,"command":91},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill auditing-cloud-with-cis-benchmarks","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-cloud-with-cis-benchmarks\u002FSKILL.md",true,[95,100,106,112,116,120,124,128,132,136],{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-cloud-with-cis-benchmarks\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",1956,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-cloud-with-cis-benchmarks\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Fagent.py","SCRIPT","脚本",6392,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fauditing-cloud-with-cis-benchmarks\u002Fscripts\u002Fagent.py",{"path":113,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Fgate_compare.py",8337,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FModel-Optimizer\u002Fblob\u002Fmain\u002Fplugins\u002Fmodelopt\u002Fskills\u002Fday0-release\u002Fscripts\u002Fgate_compare.py",{"path":117,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fgate_ptq.py",14298,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FModel-Optimizer\u002Fblob\u002Fmain\u002Fplugins\u002Fmodelopt\u002Fskills\u002Fday0-release\u002Fscripts\u002Fgate_ptq.py",{"path":121,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fgate_run.py",5825,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FModel-Optimizer\u002Fblob\u002Fmain\u002Fplugins\u002Fmodelopt\u002Fskills\u002Fday0-release\u002Fscripts\u002Fgate_run.py",{"path":125,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":126,"sourceHtmlUrl":127},"scripts\u002Fgate_verbosity.py",22981,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FModel-Optimizer\u002Fblob\u002Fmain\u002Fplugins\u002Fmodelopt\u002Fskills\u002Fday0-release\u002Fscripts\u002Fgate_verbosity.py",{"path":129,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":130,"sourceHtmlUrl":131},"tests\u002Fevals.json",6612,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FModel-Optimizer\u002Fblob\u002Fmain\u002Fplugins\u002Fmodelopt\u002Fskills\u002Fday0-release\u002Ftests\u002Fevals.json",{"path":133,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":134,"sourceHtmlUrl":135},"tests\u002Ftest_agent_definitions.py",3668,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FModel-Optimizer\u002Fblob\u002Fmain\u002Fplugins\u002Fmodelopt\u002Fskills\u002Fday0-release\u002Ftests\u002Ftest_agent_definitions.py",{"path":137,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":138,"sourceHtmlUrl":139},"tests\u002Ftest_gates.py",33430,"https:\u002F\u002Fgithub.com\u002FNVIDIA\u002FModel-Optimizer\u002Fblob\u002Fmain\u002Fplugins\u002Fmodelopt\u002Fskills\u002Fday0-release\u002Ftests\u002Ftest_gates.py",[141,166,190,217,243,270],{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":148,"publishedAt":48},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[147],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[149,150,151,152,40,47,153,154,45,155,156,157,158,159,160,161,162,163,164,165],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":173,"publishedAt":48},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[172],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[174,162,175,176,40,177,47,45,178,179,180,181,182,183,184,185,186,187,188,189],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":200,"publishedAt":48},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[196,199],{"categoryNo":197,"categoryName":198,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[184,201,202,203,204,47,205,206,178,39,207,208,209,210,211,212,213,214,215,216],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":218,"name":219,"nameZh":6,"description":220,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":221,"categories":222,"keywords":224,"publishedAt":48},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[223],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[225,226,227,47,228,229,230,231,232,233,234,235,236,237,238,239,181,240,241,242],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":244,"name":245,"nameZh":6,"description":246,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":247,"categories":248,"keywords":250,"publishedAt":48},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[249],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[251,252,253,47,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":271,"name":272,"nameZh":6,"description":273,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":274,"categories":275,"keywords":277,"publishedAt":48},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[276],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[40,278,47,279,280,281,282,283,284,285,286,212,287,213,288,289,290,291,292,293],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]