Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-24 09:28:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 31

13461-missing-win10-CIS-9.3.9 (#13514)

Browse source
This commit is contained in:
Sharon Katz 2023-08-25 13:37:03 -04:00 committed by GitHub
parent 479976460b
commit 80df9e4c51
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
ee/cis/win-10/cis-policy-queries.yml
View file

@ -3616,6 +3616,27 @@ spec:
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'Windows Firewall: Public: Logging: Log dropped packets' is set to 'Yes'
platforms: win10
platform: windows
description: |
Use this option to log when Windows Firewall with Advanced Security discards an inbound packet
for any reason. The log records why and when the packet was dropped. Look for entries with the
word DROP in the action column of the log.
The recommended state for this setting is: Yes.
resolution: |
To establish the recommended configuration via GP, set the following UI path to Yes:
'Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Logging Customize\Log dropped packets'
query: |
SELECT * FROM registry WHERE (key = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\Logging\LogDroppedPackets' and data == 1);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_9.3.9
contributors: RachelElysia
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'Windows Firewall: Public: Logging: Log successful connections' is set to 'Yes'