Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-24 09:28:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 52

Add Windows 10 CIS 18.9.66-67 (#11143)

Browse source 
This is all 6 queries referenced in #10361. I've tested all queries on
Windows 10 Pro.

- [x] Manual QA for all new/changed functionality
This commit is contained in:
Artemis Tosini 2023-04-25 13:04:38 -04:00 committed by GitHub
parent e3729ffae0
commit eb8de78a62
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 108 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

108
ee/cis/win-10/cis-policy-queries.yml
View file

@ -7092,6 +7092,114 @@ spec:
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'Prevent downloading of enclosures' is set to 'Enabled'
platforms: win10
platform: windows
description: |
This policy setting prevents the user from having enclosures (file attachments) downloaded from an RSS feed to the user's computer.
resolution: |
To establish the recommended configuration via GP, set the following UI path to 'Enabled':
'Computer Configuration\Policies\Administrative Templates\Windows Components\RSS Feeds\Prevent downloading of enclosures'
query: |
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Feeds\\DisableEnclosureDownload' AND data = 1);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_18.9.66.1
contributors: artemist-work
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'Allow Cloud Search' is set to 'Enabled: Disable Cloud Search'
platforms: win10
platform: windows
description: |
This policy setting allows search and Cortana to search cloud sources like OneDrive and SharePoint.
resolution: |
To establish the recommended configuration via GP, set the following UI path to 'Enabled', then 'Disable Cloud Search':
'Computer Configuration\Policies\Administrative Templates\Windows Components\Search\Allow Cloud Search'
query: |
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search\\AllowCloudSearch' AND data = 0);
purpose: Informational
tags: compliance, CIS, CIS_Level2, CIS_win10_enterprise_1.12.0, CIS_bullet_18.9.67.2
contributors: artemist-work
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'Allow Cortana' is set to 'Disabled'
platforms: win10
platform: windows
description: |
This policy setting specifies whether Cortana is allowed on the device.
resolution: |
To establish the recommended configuration via GP, set the following UI path to 'Disabled':
'Computer Configuration\Policies\Administrative Templates\Windows Components\Search\Allow Cortana'
query: |
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search\\AllowCortana' AND data = 0);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_18.9.67.3
contributors: artemist-work
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'Allow Cortana above lock screen' is set to 'Disabled'
platforms: win10
platform: windows
description: |
This policy setting determines whether or not the user can interact with Cortana using speech while the system is locked.
resolution: |
To establish the recommended configuration via GP, set the following UI path to 'Disabled':
query: |
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search\\AllowCortanaAboveLock' AND data = 0);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_18.9.67.4
contributors: artemist-work
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'Allow indexing of encrypted files' is set to 'Disabled'
platforms: win10
platform: windows
description: |
This policy setting controls whether encrypted items are allowed to be indexed.
resolution: |
To establish the recommended configuration via GP, set the following UI path to 'Disabled':
'Computer Configuration\Policies\Administrative Templates\Windows Components\Search\Allow indexing of encrypted files'
query: |
TODO
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search\\AllowIndexingEncryptedStoresOrItems' AND data = 0);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_18.9.67.5
contributors: artemist-work
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'Allow search and Cortana to use location' is set to 'Disabled'
platforms: win10
platform: windows
description: |
This policy setting specifies whether search and Cortana can provide location aware search and Cortana results.
resolution: |
To establish the recommended configuration via GP, set the following UI path to 'Disabled':
'Computer Configuration\Policies\Administrative Templates\Windows Components\Search\Allow search and Cortana to use location'
query: |
SELECT 1 FROM registry WHERE (path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search\\AllowSearchToUseLocation' AND data = 0);
purpose: Informational
tags: compliance, CIS, CIS_Level1, CIS_win10_enterprise_1.12.0, CIS_bullet_18.9.67.6
contributors: artemist-work
---
apiVersion: v1
kind: policy
spec:
name: >
CIS - Ensure 'Do not allow passwords to be saved' is set to 'Enabled'