Playbook catalogue
The 129 remediation playbooks Obexum ships — 55 for Windows AD domain controllers, 30 for Windows member servers, 44 for Linux, BSD and cross-platform — generated from the playbook library (internal/remediation/kb/templates), plus the 57 one-click recipes the hosted portal cockpit can apply and verify. Each is dry-run by default, carries a rollback section, advisory notes, and a post-fix validation hook. Render one with obexum playbook render <id> --target <host>.
| Playbook ID | Title | Fixes | Risk | Est. time | Reboot |
|---|---|---|---|---|---|
| Windows Server — Active Directory domain controllers — 55 | |||||
pb-windows-dc-acl-001 | Remove non-Tier0 DCSync extended right from domain root | AUD-WIN-ACL-001 | medium | 30s | never |
pb-windows-dc-acl-002 | Strip non-Tier0 ACE from AdminSDHolder | AUD-WIN-ACL-002 | medium | 30s | never |
pb-windows-dc-acl-003 | Strip non-Tier0 takeover ACE from Tier0 group | AUD-WIN-ACL-003 | medium | 30s | never |
pb-windows-dc-acl-004 | Strip non-Tier0 takeover ACE from domain root | AUD-WIN-ACL-004 | high | 30s | never |
pb-windows-dc-acl-008 | Strip non-Tier0 GenericAll/Write ACE from Tier0 user | AUD-WIN-ACL-008 | medium | 30s | never |
pb-windows-dc-acl-009 | Strip Shadow Credentials write ACE (msDS-KeyCredentialLink) | AUD-WIN-ACL-009 | medium | 30s | never |
pb-windows-dc-acl-010 | Restore Tier0 object owner to Domain Admins | AUD-WIN-ACL-010 | medium | 30s | never |
pb-windows-dc-acl-011 | Strip non-Tier0 ACE from Domain Controllers OU | AUD-WIN-ACL-011 | high | 30s | never |
pb-windows-dc-acl-012 | Strip non-Tier0 write ACE from DC computer object | AUD-WIN-ACL-012 | high | 30s | never |
pb-windows-dc-adcs-001 | ADCS ESC1 - disable + unpublish SAN-supply template | AUD-WIN-ADCS-001 | medium | 2m | never |
pb-windows-dc-adcs-002 | ADCS ESC2 - disable + remove Any-Purpose EKU template | AUD-WIN-ADCS-002 | medium | 2m | never |
pb-windows-dc-adcs-004 | ADCS ESC4 - strip non-Tier0 write ACEs from certificate template | AUD-WIN-ADCS-004 | medium | 1m | never |
pb-windows-dc-adcs-006 | ADCS ESC6 - clear EDITF_ATTRIBUTESUBJECTALTNAME2 on CA | AUD-WIN-ADCS-006 | low | 30s | never |
pb-windows-dc-adcs-008 | ADCS ESC8 - disable HTTP web enrollment, require HTTPS + EPA | AUD-WIN-ADCS-008 | medium | 1m | never |
pb-windows-dc-adcs-009 | ADCS ESC9 - clear no_security_extension flag from template | AUD-WIN-ADCS-009 | low | 30s | never |
pb-windows-dc-adcs-015 | ADCS ESC15 / EKUwu - disable + remove schema-v1 + SAN-supply template | AUD-WIN-ADCS-015 | medium | 2m | never |
pb-windows-dc-dc-001 | Enforce LDAP signing on Domain Controller (LDAPServerIntegrity = 2) | AUD-WIN-DC-001 | medium | 30s | never |
pb-windows-dc-dc-002 | Enforce LDAP channel binding (LdapEnforceChannelBinding = 2) | AUD-WIN-DC-002 | medium | 30s | never |
pb-windows-dc-dc-003 | Disable anonymous SAM enumeration (RestrictAnonymous combo) | AUD-WIN-DC-003 | low | 15s | never |
pb-windows-dc-dc-005 | Refuse NTLMv1 / LM (LmCompatibilityLevel=5 + NoLMHash=1) | AUD-WIN-DC-005 | medium | 30s | never |
pb-windows-dc-dch-001 | Disable + stop Print Spooler service on Domain Controller | AUD-WIN-DCH-001 | low | 30s | never |
pb-windows-dc-dch-002 | Restrict Point-and-Print to administrators (PrintNightmare follow-up) | AUD-WIN-DCH-002 | low | 15s | never |
pb-windows-dc-dch-004 | Restrict DSRM admin to DSRM mode only (DsrmAdminLogonBehavior=2) | AUD-WIN-DCH-004 | low | 15s | never |
pb-windows-dc-dch-008 | Apply auditpol baseline (Success+Failure on critical subcategories) | AUD-WIN-DCH-008 | low | 30s | never |
pb-windows-dc-dch-009 | Enable NTLM inbound restriction + audit on DC | AUD-WIN-DCH-009 | low | 15s | never |
pb-windows-dc-dch-010 | Disable WDigest cleartext credentials in LSASS | AUD-WIN-DCH-010 | low | 15s | never |
pb-windows-dc-fh-003 | Enable AD Recycle Bin Optional Feature | AUD-WIN-FH-003 | medium | 30s | never |
pb-windows-dc-fh-006 | Harden Default Domain Password Policy | AUD-WIN-FH-006 | high | 30s | never |
pb-windows-dc-fh-007 | Clear dSHeuristics anonymous-bind bit | AUD-WIN-FH-007 | low | 15s | never |
pb-windows-dc-krb-005 | Rotate krbtgt password (twice, >=10h apart) | AUD-WIN-KRB-005 | high | 1m | never |
pb-windows-dc-krb-007 | Set krbtgt enctype to AES-only (msDS-SupportedEncryptionTypes=0x18) | AUD-WIN-KRB-007 | medium | 30s | never |
pb-windows-dc-krb-008 | Add Domain Admins to Protected Users (or set AccountIsSensitive) | AUD-WIN-KRB-008 | medium | 30s | never |
pb-windows-dc-krb-010 | Set ms-DS-MachineAccountQuota = 0 (block NoPac prereq) | AUD-WIN-KRB-010 | medium | 15s | never |
pb-windows-dc-pers-t-007 | Restore Winlogon Userinit to baseline | AUD-WIN-PERS-T-007 | medium | 15s | never |
pb-windows-dc-pers-t-008 | Restore Winlogon Shell to baseline ('explorer.exe') | AUD-WIN-PERS-T-008 | medium | 15s | never |
pb-windows-dc-pers-t-009 | Remove Winlogon Taskman value | AUD-WIN-PERS-T-009 | low | 15s | never |
pb-windows-dc-pers-t-010 | Remove Winlogon GinaDLL value | AUD-WIN-PERS-T-010 | low | 15s | never |
pb-windows-dc-pers-t-012 | Remove Winlogon Notify subkey | AUD-WIN-PERS-T-012 | low | 15s | never |
pb-windows-dc-pers-x-001 | Remove IFEO Debugger value from <exe> | AUD-WIN-PERS-X-001 | low | 15s | never |
pb-windows-dc-pers-x-005 | Clear AppInit_DLLs + LoadAppInit_DLLs | AUD-WIN-PERS-X-005 | low | 15s | never |
pb-windows-dc-pers-x-011 | Investigate + remove kernel driver service with off-System32 ImagePath | AUD-WIN-PERS-X-011 | high | 5m | auto |
pb-windows-dc-pers-x-015 | Investigate + remove svchost service with ServiceDll off-System32 | AUD-WIN-PERS-X-015 | high | 5m | never |
pb-windows-dc-pg-004 | Remove non-Tier0 member from DnsAdmins | AUD-WIN-PG-004 | low | 15s | never |
pb-windows-dc-pg-006 | Remove broad principal from Pre-Windows 2000 Compatible Access | AUD-WIN-PG-006 | medium | 15s | never |
pb-windows-dc-pg-007 | Deploy Windows LAPS on the domain (schema + GPO) | AUD-WIN-PG-007 | high | 5m | never |
pb-windows-dc-pg-008 | Strip non-Tier0 ExtendedRight on LAPS password attribute | AUD-WIN-PG-008 | low | 30s | never |
pb-windows-dc-priv-004 | Clear DNS ServerLevelPluginDll registry value | AUD-WIN-PRIV-004 | medium | 30s | never |
pb-windows-dc-priv-006 | Disable PowerShell v2 Optional Feature | AUD-WIN-PRIV-006 | low | 1m | auto |
pb-windows-dc-priv-007 | Remove off-baseline AMSI Provider CLSID | AUD-WIN-PRIV-007 | low | 15s | never |
pb-windows-dc-priv-009 | Enable LSASS Protected Process Light (RunAsPPL) | AUD-WIN-PRIV-009 | medium | 1m | always |
pb-windows-dc-priv-010 | Reset LocalAccountTokenFilterPolicy to default (=0) | AUD-WIN-PRIV-010 | low | 15s | never |
pb-windows-dc-priv-011 | Restore UAC ConsentPromptBehaviorAdmin to baseline (=5) | AUD-WIN-PRIV-011 | low | 15s | never |
pb-windows-dc-priv-012 | Remove HKU auto-elevate hijack subkeys | AUD-WIN-PRIV-012 | low | 15s | never |
pb-windows-dc-priv-014 | Disable RDP RestrictedAdmin pass-the-hash | AUD-WIN-PRIV-014 | low | 15s | never |
pb-windows-dc-priv-015 | Harden DLL search-order (SafeDllSearchMode + CWDIllegalInDllSearch) | AUD-WIN-PRIV-015 | low | 15s | never |
| Windows Server — member / standalone — 30 | |||||
win-threat-001-defender-realtime | Re-enable Microsoft Defender real-time monitoring | AUD-WIN-THREAT-001 | low | 1m | never |
win-threat-005-asr-audit-first | Enable Microsoft Defender ASR rules (Audit mode first) | AUD-WIN-THREAT-005 | low | 2m | never |
win-threat-002-cloud-protection | Enable Defender cloud protection + sample submission + update signatures | AUD-WIN-THREAT-002 | low | 2m | never |
win-threat-003-tamper-protection | Turn on Microsoft Defender Tamper Protection | AUD-WIN-THREAT-003 | manual | 2m | never |
win-crypto-002-ntlm-restrict | Restrict outbound NTLM + audit inbound NTLM | AUD-WIN-CRYPTO-002 | medium | — | never |
win-crypto-003-ldap-signing | Require LDAP client signing | AUD-WIN-CRYPTO-003 | medium | — | never |
win-ident-010-cached-creds | Reduce cached domain logon count to 4 | AUD-WIN-IDENT-010 | medium | — | never |
win-integ-006-autorun | Disable AutoPlay / AutoRun (USB privesc surface) | AUD-WIN-INTEG-006 | low | — | never |
win-net-005-wpad | Disable the WinHTTP Web Proxy Auto-Discovery service (WPAD) | AUD-WIN-NET-005 | medium | — | never |
win-priv-015-safedll | Enforce SafeDllSearchMode + CWDIllegalInDllSearch | AUD-WIN-PRIV-015 | medium | — | never |
win-threat-006-netprotect-cfa | Enable Defender Network Protection + PUA (and CFA on client) | AUD-WIN-THREAT-006 | low | — | never |
win-log-006-sysmon | Install + configure Sysmon for deep telemetry | AUD-WIN-LOG-006 | manual | — | never |
win-integ-002-bootintegrity | Boot integrity (Secure Boot / TPM / ELAM) below baseline | AUD-WIN-INTEG-002 | manual | — | always |
win-ident-009-runasppl | Enable LSASS protection (RunAsPPL) | AUD-WIN-IDENT-009 | medium | 2m | always |
win-ident-011-uac | Harden UAC (admin approval mode for built-in admin) | AUD-WIN-IDENT-011 | medium | 1m | never |
win-ident-006-anonymous | Restrict anonymous / null-session access | AUD-WIN-IDENT-006 | medium | 1m | never |
win-ident-003-password-policy | Set local password policy to baseline | AUD-WIN-IDENT-003 | medium | 1m | never |
win-ident-004-lockout-policy | Set account lockout policy to baseline | AUD-WIN-IDENT-004 | medium | 1m | never |
win-crypto-001-ntlm-minsec | Enforce NTLM session security (NTLMv2 + 128-bit) | AUD-WIN-CRYPTO-001 | medium | 1m | never |
win-priv-014-restrictedadmin | Disable RestrictedAdmin mode for outbound RDP | AUD-WIN-PRIV-014 | medium | 1m | never |
win-ident-001-disable-builtin-admin | Disable the built-in Administrator account (RID 500) | AUD-WIN-IDENT-001 | high | 2m | never |
win-ident-012-sensitive-privs | Review sensitive user-rights granted to non-admins | AUD-WIN-IDENT-012 | manual | 10m | never |
win-log-002-audit-subcategories | Enable Windows advanced audit policy subcategories | AUD-WIN-LOG-002 | low | 1m | never |
win-log-004-cmdline-audit | Include command line in process-creation events (4688) | AUD-WIN-LOG-004 | low | 1m | never |
win-log-001-powershell-logging | Enable PowerShell Script Block + Module + Transcription logging | AUD-WIN-LOG-001 | low | 1m | never |
win-log-003-eventlog-size | Raise Event Log channel sizes and set safe retention | AUD-WIN-LOG-003 | low | 1m | never |
win-net-003-llmnr-netbios | Disable LLMNR and NetBIOS-over-TCP name resolution | AUD-WIN-NET-003 | medium | 1m | never |
win-net-002-smb-signing | Require SMB signing (client and server) | AUD-WIN-NET-002 | high | 2m | never |
win-net-004-firewall-baseline | Enable Windows Firewall on all profiles with default-block inbound | AUD-WIN-NET-004 | high | 2m | never |
win-priv-006-remove-powershell-v2 | Remove the PowerShell 2.0 engine | AUD-WIN-PRIV-006 | medium | 3m | auto |
| Debian / Ubuntu — 28 | |||||
REM-DEB-DOCKER-LIVERESTORE | Enable Docker live-restore | CFG-DOCKER-003 | low | — | — |
REM-DEB-DOCKER-LOGROTATE | Set Docker log rotation (max-size/max-file) | CFG-DOCKER-006 | low | — | — |
REM-DEB-FAIL2BAN-INSTALL | Install + enable fail2ban with SSH jail | findings from lynis | low | 30s | — |
REM-DEB-UFW-ENABLE | Enable UFW with default-deny incoming | CFG-UFW-00[12] | high | 15s | — |
REM-DEB-LOGINDEFS-POLICY | Apply strict /etc/login.defs password policy | CFG-LOGIN-00[1-5] | low | 15s | — |
REM-DEB-CHAGE-USERS | Apply PASS_MAX_DAYS retroactively to existing accounts (safe) | (CFG-LOGIN-001|AUTH-9282) | low | — | — |
REM-DEB-PAM-PWQUALITY | Install and enforce pam_pwquality | CFG-PAM-001 | low | — | — |
REM-DEB-DIST-UPGRADE | Upgrade all Debian/Ubuntu packages with security fixes | CVE- | low | 5-15m | auto |
REM-DEB-KERNEL-UPGRADE | Upgrade Linux kernel (requires reboot) | findings in category cve | medium | 3-8m + reboot | always |
REM-DEB-AUTOREMOVE | Remove orphaned packages & old kernels | (CVE-|PKGS-) | low | 1-3m | — |
REM-DEB-INSTALL-UPDATES | Install debsums / apt-show-versions / pam-pwquality | (PKGS-7370|PKGS-7394|AUTH-9262) | low | 1m | — |
REM-DEB-PURGE-REMOVED | Purge config files of removed packages | PKGS-7346 | low | 30s | — |
REM-DEB-UNATTENDED-UPGRADES | Enable automatic security updates | findings from lynis | low | 2m | — |
REM-DEB-UPGRADE-SINGLE | Upgrade specific package | findings in category cve | low | 30s | — |
REM-DEB-POSTGRES-LISTEN | Bind PostgreSQL to localhost only | CFG-PG-001 | high | 30s | — |
REM-DEB-PG-HBA-SCRAM | Replace pg_hba trust/md5 with scram-sha-256 | CFG-PG-00[23] | high | 30s | — |
REM-DEB-REDIS-BIND-PASSWORD | Bind Redis to localhost + require password | CFG-REDIS-001$|^CFG-REDIS-003 | high | 45s | — |
REM-DEB-MYSQL-BIND-LOCAL | Bind MySQL to localhost | CFG-MYSQL-001 | high | — | — |
REM-DEB-CADDY-HSTS | Add HSTS + security headers to Caddy | CFG-CADDY-00[2-7] | medium | 30s | — |
REM-DEB-NGINX-HSTS | Add HSTS to Nginx | CFG-NGINX-00[456] | low | 30s | — |
REM-DEB-NGINX-NO-SERVER-TOKENS | Disable Nginx server_tokens (hide version) | CFG-NGINX-003 | low | — | — |
REM-DEB-SSH-ROOTLOGIN | Disable direct root SSH password login | CFG-SSH-001 | low | 30s | — |
REM-DEB-SSH-PASSWORDAUTH | Disable SSH password authentication | CFG-SSH-002 | medium | 30s | — |
REM-DEB-SSH-EMPTYPASS | Disable SSH empty-password logins | CFG-SSH-003 | low | — | — |
REM-DEB-SSH-MAXAUTHTRIES | Restrict SSH MaxAuthTries to 3 | CFG-SSH-004 | low | — | — |
REM-DEB-SSH-MODERNCRYPTO | Enforce modern SSH ciphers/MACs/KEX | CFG-SSH-00[67]$|^CFG-SSH-013 | low | — | — |
REM-DEB-SSH-IDLE-TIMEOUT | Set SSH idle timeout (ClientAliveInterval) | CFG-SSH-011 | low | — | — |
REM-DEB-SYSCTL-HARDEN | Apply kernel sysctl hardening profile | CFG-SYSCTL-|^KRNL- | low | 10s | — |
| Ubuntu-specific — 1 | |||||
REM-UBU-KERNEL-GENERIC | Upgrade Ubuntu linux-generic kernel (requires reboot) | findings in category cve | medium | 3-8m + reboot | always |
| RHEL family (Rocky / Alma / Oracle) — 2 | |||||
REM-RHEL-DNF-UPGRADE | Upgrade all packages (dnf upgrade) | CVE- | low | 5-15m | auto |
REM-RHEL-KERNEL | Upgrade kernel (RHEL family) | findings in category cve | medium | — | always |
| Alpine — 1 | |||||
REM-ALPINE-APK-UPGRADE | Upgrade Alpine packages (apk upgrade) | CVE- | low | 2-5m | auto |
| Linux — all distributions — 7 | |||||
lin-fs-cron-perms | Tighten ownership and permissions on cron directories and files | AUD-LIN-FS-042 | low | 1m | never |
lin-net-sysctl-hardening | Apply kernel sysctl network + memory hardening baseline | AUD-LIN-NET-011 | medium | 1m | never |
lin-fs-tmp-sticky | Set the sticky bit on /tmp and /var/tmp | AUD-LIN-FS-035 | low | 1m | never |
lin-fs-umask | Set a restrictive default umask (027) for new login sessions | AUD-LIN-FS-014 | low | 1m | never |
lin-fs-login-defs | Harden /etc/login.defs password + login policy | AUD-LIN-FS-015 | medium | 1m | never |
lin-fs-coredump-disable | Disable core dumps (limits.conf + suid_dumpable + systemd-coredump) | AUD-LIN-FS-028 | low | 1m | never |
lin-log-journald | Make systemd-journald persistent and set an explicit retention policy | AUD-LIN-LOG-023 | low | 1m | never |
| Cross-platform — 2 | |||||
REM-SECRETS-ROTATE | Rotate leaked secret | findings in category secret | manual | 15-60m | — |
REM-SECRETS-REMOVE-FROM-FILE | Remove secret string from the file | findings in category secret | manual | 10m | — |
| Perimeter defense (threat-intel driven) — 3 | |||||
REM-DEFENSE-UFW-BLOCK | Block attacker IP(s) via UFW | findings from threatintel tagged external-attacker | low | 1s per IP | — |
REM-DEFENSE-IPSET | Add attacker IPs to ipset + iptables (high-volume) | findings from threatintel tagged external-attacker | medium | fast, bulk | — |
REM-DEFENSE-FAIL2BAN-PERMA | Install fail2ban persistent-ban plugin | findings from threatintel tagged external-attacker | low | — | — |
One-click portal recipes (57)
Executable recipes the hosted portal’s remediation cockpit renders per engagement — OS-aware (36 Windows · 18 Linux · 3 BSD), each with pre-check, idempotent commands, an effective-state post-check that reproduces the scanner’s own logic, and rollback. Generated from internal/remediate/recipes. Findings without a recipe still carry guided manual remediation.
| Recipe ID | Title | Clears rule_ids | Tier | Risk | Reboot |
|---|---|---|---|---|---|
| windows — 36 | |||||
win-ident-guest-disable | Disable the built-in Guest account (well-known RID 501) | AUD-WIN-IDENT-002 | P1 | low | never |
win-ident-005-blank-pwd | Block network logon with blank passwords (LimitBlankPasswordUse) | AUD-WIN-IDENT-005 | P1 | low | never |
win-priv-latfp-reset | Restore UAC remote-token filtering (LocalAccountTokenFilterPolicy = 0) | AUD-WIN-PRIV-010 | P2 | medium | never |
win-pers-aie | Clear AlwaysInstallElevated privesc keys (both hives) | AUD-WIN-PERS-001 | P1 | low | never |
win-threat-exploit-protection | Enable system-wide Exploit Protection (DEP/SEHOP/ASLR/CFG) | AUD-WIN-THREAT-007 | P2 | medium | auto |
win-integ-kernel-dma-block | Set Kernel DMA Protection device enumeration policy to Block all | AUD-WIN-INTEG-003 | P1 | low | always |
win-threat-001-defender-realtime | Re-enable Microsoft Defender real-time monitoring | AUD-WIN-THREAT-001 | P1 | low | never |
win-threat-005-asr-audit-first | Enable Microsoft Defender ASR rules (Audit mode first) | AUD-WIN-THREAT-005 | P1 | low | never |
win-threat-002-cloud-protection | Enable Defender cloud protection + sample submission + update signatures | AUD-WIN-THREAT-002 | P1 | low | never |
win-threat-003-tamper-protection | Turn on Microsoft Defender Tamper Protection | AUD-WIN-THREAT-003 | manual | manual | never |
win-crypto-002-ntlm-restrict | Restrict outbound NTLM + audit inbound NTLM | AUD-WIN-CRYPTO-002 | P2 | medium | never |
win-crypto-003-ldap-signing | Require LDAP client signing | AUD-WIN-CRYPTO-003 | P2 | medium | never |
win-ident-010-cached-creds | Reduce cached domain logon count to 4 | AUD-WIN-IDENT-010 | P2 | medium | never |
win-integ-006-autorun | Disable AutoPlay / AutoRun (USB privesc surface) | AUD-WIN-INTEG-006 | P2 | low | never |
win-net-005-wpad | Disable the WinHTTP Web Proxy Auto-Discovery service (WPAD) | AUD-WIN-NET-005 | P2 | medium | never |
win-priv-015-safedll | Enforce SafeDllSearchMode + CWDIllegalInDllSearch | AUD-WIN-PRIV-015 | P2 | medium | never |
win-threat-006-netprotect-cfa | Enable Defender Network Protection + PUA (and CFA on client) | AUD-WIN-THREAT-006 | P2 | low | never |
win-log-006-sysmon | Install + configure Sysmon for deep telemetry | AUD-WIN-LOG-006 | manual | manual | never |
win-integ-002-bootintegrity | Boot integrity (Secure Boot / TPM / ELAM) below baseline | AUD-WIN-INTEG-002 | manual | manual | always |
win-ident-009-runasppl | Enable LSASS protection (RunAsPPL) | AUD-WIN-(IDENT-009|PRIV-009) | P2 | medium | always |
win-ident-011-uac | Harden UAC (admin approval mode for built-in admin) | AUD-WIN-(IDENT-011|PRIV-011) | P2 | medium | never |
win-ident-006-anonymous | Restrict anonymous / null-session access | AUD-WIN-IDENT-006 | P2 | medium | never |
win-ident-003-password-policy | Set local password policy to baseline | AUD-WIN-IDENT-003 | P2 | medium | never |
win-ident-004-lockout-policy | Set account lockout policy to baseline | AUD-WIN-IDENT-004 | P2 | medium | never |
win-crypto-001-ntlm-minsec | Enforce NTLM session security (NTLMv2 + 128-bit) | AUD-WIN-CRYPTO-001 | P2 | medium | never |
win-priv-014-restrictedadmin | Disable RestrictedAdmin mode for outbound RDP | AUD-WIN-PRIV-014 | P2 | medium | never |
win-ident-001-disable-builtin-admin | Disable the built-in Administrator account (RID 500) | AUD-WIN-IDENT-001 | P3 | high | never |
win-ident-012-sensitive-privs | Review sensitive user-rights granted to non-admins | AUD-WIN-IDENT-012 | manual | manual | never |
win-log-002-audit-subcategories | Enable Windows advanced audit policy subcategories | AUD-WIN-LOG-002 | P1 | low | never |
win-log-004-cmdline-audit | Include command line in process-creation events (4688) | AUD-WIN-LOG-004 | P1 | low | never |
win-log-001-powershell-logging | Enable PowerShell Script Block + Module + Transcription logging | AUD-WIN-LOG-001 | P1 | low | never |
win-log-003-eventlog-size | Raise Event Log channel sizes and set safe retention | AUD-WIN-LOG-003 | P1 | low | never |
win-net-003-llmnr-netbios | Disable LLMNR and NetBIOS-over-TCP name resolution | AUD-WIN-NET-003 | P2 | medium | never |
win-net-002-smb-signing | Require SMB signing (client and server) | AUD-WIN-NET-002 | P3 | high | never |
win-net-004-firewall-baseline | Enable Windows Firewall on all profiles with default-block inbound | AUD-WIN-NET-004 | P3 | high | never |
win-priv-006-remove-powershell-v2 | Remove the PowerShell 2.0 engine | AUD-WIN-PRIV-006 | P2 | medium | auto |
| linux — 18 | |||||
lin-ssh-crypto | Pin modern SSH KEX/ciphers/MACs via sshd drop-in | (AUD-LIN-PROBE-001|AUD-LIN-NET-034|CFG-SSH-(006|007|013)) | P2 | medium | never |
lin-ssh-session-policy | Apply SSH session limits, idle timeout, X11 off, and a non-leaky login banner | (AUD-LIN-PROBE-003|CFG-SSH-(004|005|008|009|011|014|018)) | P2 | low | never |
lin-login-defs-cis | Apply CIS password aging and login.defs policy baseline | (AUD-LIN-FS-015|AUD-LIN-IDENT-010|CFG-LOGIN-(001|002|003|004|005)) | P1 | medium | never |
lin-fs-kernfs-sysctl | Apply kernel/fs sysctl hardening baseline (beyond NET-011) | (AUD-LIN-FS-(017|047)|CFG-SYSCTL-(006|009|011|014)) | P1 | low | never |
lin-pam-pwquality-faillock | Enforce PAM password quality and account lockout (pwquality + faillock + pwhistory) | (AUD-LIN-IDENT-013|CFG-PAM-(001|003|005|006|008|009|010)) | P3 | high | never |
lin-fs-module-blacklist | Blacklist legacy/rare/physical-access kernel modules (modprobe drop-in) | AUD-LIN-FS-02[345] | P2 | low | never |
lin-sudoers-session-logging | Enable sudo session command + I/O logging (log_input/log_output) | CFG-SUDOERS-004 | P1 | low | never |
lin-log-auditd-baseline | Install auditd and load a CIS-aligned baseline audit ruleset | AUD-LIN-LOG-(001|004|006|007|008|009|010|011|012|013|014|016|017|018|019) | P3 | medium | never |
lin-fs-mount-flags | Add nodev/nosuid/noexec to already-separate sensitive mount points | AUD-LIN-FS-001 | P2 | medium | never |
lin-pg-forensic-logging | Enable PostgreSQL connection and forensic query logging | CFG-PG-0(08|09|11|13) | P2 | low | never |
lin-log-journald | Make systemd-journald persistent and set an explicit retention policy | AUD-LIN-LOG-(023|024) | P2 | low | never |
lin-ssh-access | Restrict root login and disable SSH password auth (Linux, opt-in) | CFG-SSH-(001|002) | P3 | high | never |
lin-firewall-fail2ban | Enable a default-deny host firewall (SSH-allowed first) plus fail2ban SSH jail | AUD-LIN-NET-(009|010|021) | P3 | high | never |
lin-fs-cron-perms | Tighten ownership and permissions on cron directories and files | AUD-LIN-FS-042 | P1 | low | never |
lin-net-sysctl-hardening | Apply full kernel sysctl network + hardening baseline (CIS) | (AUD-LIN-NET-011|CFG-SYSCTL-(004|007|012|015)) | P2 | medium | never |
lin-fs-tmp-sticky | Set the sticky bit on /tmp and /var/tmp | AUD-LIN-FS-035 | P1 | low | never |
lin-fs-umask | Enforce a consistent restrictive default umask (027) across all shell-init sources | (AUD-LIN-FS-014|AUD-LIN-IDENT-012) | P2 | low | never |
lin-fs-coredump-disable | Disable core dumps (limits.conf + suid_dumpable + systemd-coredump) | AUD-LIN-FS-(028|029) | P2 | low | never |
| bsd — 3 | |||||
bsd-ssh-crypto | Pin strong SSH ciphers/MACs/KEX (BSD, direct sshd_config edit) | CFG-SSH-(006|007|013) | P2 | medium | never |
bsd-ssh-policy | Apply SSH session limits + login banner (BSD) | CFG-SSH-(004|005|009|011|014|018) | P2 | low | never |
bsd-ssh-access | Restrict root login + disable SSH password auth (BSD, opt-in) | CFG-SSH-(001|002) | P3 | high | never |