Skip to content

Commit 3c8bf05

Browse files
allenhouchinscoderabbitai[bot]
allenhouchins
and
coderabbitai[bot]
authored
Add security policies and reports to Workstations (#43457)
Add multiple endpoint security policies and telemetry reports and wire them into the workstations fleet manifest. New macOS policies: firewall, Gatekeeper, SIP (critical), Remote Login disabled, screen-lock inactivity, and local-admin count; new Windows policies: Secure Boot, Remote Desktop disabled, interactive screen-lock timeout; new Linux policy: sshd PermitRootLogin restriction. Added cross-platform reports for disk encryption (includes BitLocker), local user/admin inventory, USB devices, listening ports, and Chromium-family browser extensions. These changes improve compliance and detection coverage (SOC2/ISO mappings included) and enable more comprehensive fleet monitoring. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added device compliance checks: macOS firewall, Gatekeeper, SIP, local admin count, Windows Secure Boot, and Linux SSH root-login restriction * Disabled high-risk remote access: macOS Remote Login and Windows Remote Desktop checks * Added screen-lock inactivity checks for macOS and Windows * New inventory reports: local user accounts, connected USB devices, open listening ports, and browser extensions (Safari, Firefox, Chromium-family) <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
1 parent 56f0abb commit 3c8bf05

17 files changed

Lines changed: 301 additions & 0 deletions

‎it-and-security/fleets/workstations.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,12 @@ policies:
162162
- path: ../lib/macos/policies/patch-fleet-maintained-apps.yml
163163
- path: ../lib/macos/policies/update-fleet-desktop.yml
164164
- path: ../lib/macos/policies/battery-health-check.yml
165+
- path: ../lib/macos/policies/firewall-enabled.yml
166+
- path: ../lib/macos/policies/gatekeeper-enabled.yml
167+
- path: ../lib/macos/policies/sip-enabled.yml
168+
- path: ../lib/macos/policies/remote-login-disabled.yml
169+
- path: ../lib/macos/policies/screen-lock-inactivity.yml
170+
- path: ../lib/macos/policies/local-admin-count-reasonable.yml
165171
# Windows policies
166172
- path: ../lib/windows/policies/antivirus-signatures-up-to-date.yml
167173
- path: ../lib/windows/policies/all-windows-updates-installed.yml
@@ -171,16 +177,26 @@ policies:
171177
- path: ../lib/windows/policies/patch-fleet-maintained-apps.yml
172178
- path: ../lib/windows/policies/battery-health-check.yml
173179
- path: ../lib/windows/policies/windows-defender-compliance-check.yml
180+
- path: ../lib/windows/policies/secure-boot-enabled.yml
181+
- path: ../lib/windows/policies/remote-desktop-disabled.yml
182+
- path: ../lib/windows/policies/screen-lock-timeout-configured.yml
174183
# Linux policies
175184
- path: ../lib/linux/policies/disk-encryption-check.yml
176185
- path: ../lib/linux/policies/disk-space-check.yml
177186
- path: ../lib/linux/policies/check-fleet-desktop-extension-enabled.yml
187+
- path: ../lib/linux/policies/sshd-permitrootlogin-restricted.yml
178188
reports:
179189
- path: ../lib/macos/reports/detect-apple-intelligence.yml
180190
- path: ../lib/macos/reports/collect-default-browser.yml
181191
- path: ../lib/macos/reports/collect-santa-denied-logs.yml
182192
- path: ../lib/macos/reports/collect-macos-27-incompatible-apps.yml
183193
- path: ../lib/all/reports/dex-queries.yml
194+
- path: ../lib/all/reports/collect-local-user-accounts.yml
195+
- path: ../lib/all/reports/collect-usb-devices.yml
196+
- path: ../lib/all/reports/collect-chromium-browser-extensions.yml
197+
- path: ../lib/all/reports/collect-safari-browser-extensions.yml
198+
- path: ../lib/all/reports/collect-firefox-browser-extensions.yml
199+
- path: ../lib/all/reports/collect-listening-ports.yml
184200
software:
185201
packages:
186202
# macOS apps

‎it-and-security/lib/all/reports/collect-chromium-browser-extensions.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
- name: Collect Chromium-family browser extensions
2+
description: |-
3+
Extension inventory across Chrome, Edge, Brave, and other Chromium-based profiles.
4+
Supports **NET-94** / ISO **A.8.23** (web/content exposure), **VPM-75** / **A.8.8** (vulnerability management), and SOC2 **CC 7.1**.
5+
query: |-
6+
SELECT
7+
u.username,
8+
ce.browser_type,
9+
ce.name,
10+
ce.identifier,
11+
ce.version,
12+
ce.profile,
13+
ce.path,
14+
ce.permissions
15+
FROM users u
16+
INNER JOIN chrome_extensions ce USING (uid)
17+
WHERE ce.name != '';
18+
interval: 86400
19+
observer_can_run: true
20+
automations_enabled: false
21+
logging: snapshot
22+
platform: darwin,linux,windows

‎it-and-security/lib/all/reports/collect-firefox-browser-extensions.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
- name: Collect Firefox browser extensions
2+
description: |-
3+
Add-on/extension inventory across Firefox profiles for all users.
4+
Supports **NET-94** / ISO **A.8.23** (web/content exposure), **VPM-75** / **A.8.8** (vulnerability management), and SOC2 **CC 7.1**.
5+
query: |-
6+
SELECT
7+
u.username,
8+
fa.name,
9+
fa.identifier,
10+
fa.creator,
11+
fa.type,
12+
fa.version,
13+
fa.description,
14+
fa.source_url,
15+
fa.active,
16+
fa.disabled,
17+
fa.autoupdate,
18+
fa.location,
19+
fa.path
20+
FROM users u
21+
INNER JOIN firefox_addons fa USING (uid)
22+
WHERE fa.name != '';
23+
interval: 86400
24+
observer_can_run: true
25+
automations_enabled: false
26+
logging: snapshot
27+
platform: darwin,linux,windows

‎it-and-security/lib/all/reports/collect-listening-ports.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
- name: Collect listening TCP/UDP ports
2+
description: |-
3+
Processes listening on network ports for anomaly detection and firewall reviews.
4+
Maps to **NET-91** / ISO **A.8.20**, **MON-121** / **A.8.16**, and SOC2 **CC 6.6** / **CC 7.2**.
5+
query: |-
6+
SELECT
7+
lp.port,
8+
lp.protocol,
9+
lp.family,
10+
lp.address,
11+
lp.path AS unix_socket_path,
12+
p.pid,
13+
p.name AS process_name,
14+
p.path AS process_path,
15+
p.cmdline
16+
FROM listening_ports lp
17+
LEFT JOIN processes p ON lp.pid = p.pid
18+
WHERE lp.port > 0
19+
ORDER BY lp.port;
20+
interval: 3600
21+
observer_can_run: true
22+
automations_enabled: false
23+
logging: snapshot
24+
platform: darwin,linux,windows

‎it-and-security/lib/all/reports/collect-local-user-accounts.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
- name: Collect local user accounts and admin membership
2+
description: |-
3+
Inventory of local user accounts with admin-equivalent membership for access reviews.
4+
Maps to Vanta **AST-66** / ISO **A.5.9** (asset inventory), **IAC-200** / **A.5.18** (access rights), and **IAC-201** / **A.8.2** (privileged access).
5+
query: |-
6+
SELECT
7+
u.uid,
8+
u.username,
9+
u.uuid,
10+
CASE WHEN EXISTS (
11+
SELECT 1
12+
FROM user_groups ug
13+
INNER JOIN groups g ON ug.gid = g.gid
14+
WHERE ug.uid = u.uid
15+
AND g.groupname IN ('admin', 'Administrators', 'sudo', 'wheel')
16+
) THEN 'yes' ELSE 'no' END AS is_admin
17+
FROM users u;
18+
interval: 86400
19+
observer_can_run: true
20+
automations_enabled: false
21+
logging: snapshot
22+
platform: darwin,linux,windows

‎it-and-security/lib/all/reports/collect-safari-browser-extensions.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
- name: Collect Safari browser extensions
2+
description: |-
3+
Extension inventory across Safari profiles for all macOS users.
4+
Supports **NET-94** / ISO **A.8.23** (web/content exposure), **VPM-75** / **A.8.8** (vulnerability management), and SOC2 **CC 7.1**.
5+
Note: Safari data is isolated per macOS user, so osquery requires Full Disk Access to read it. See https://fleetdm.com/guides/enroll-hosts#grant-full-disk-access-to-osquery-on-macos.
6+
query: |-
7+
SELECT
8+
u.username,
9+
se.name,
10+
se.identifier,
11+
se.version,
12+
se.sdk,
13+
se.description,
14+
se.path,
15+
se.bundle_version,
16+
se.copyright
17+
FROM users u
18+
INNER JOIN safari_extensions se USING (uid)
19+
WHERE se.name != '';
20+
interval: 86400
21+
observer_can_run: true
22+
automations_enabled: false
23+
logging: snapshot
24+
platform: darwin

‎it-and-security/lib/all/reports/collect-usb-devices.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
- name: Collect connected USB devices
2+
description: |-
3+
USB devices currently attached to the host (useful for removable media and exfiltration visibility).
4+
Maps to Vanta **AST-70** / ISO **A.7.10** (storage media), **CRY-3** / SOC2 **CC 6.7**, and **DCH-112** / **A.8.12** (data leakage prevention).
5+
Note: `usb_devices` is available on macOS and Linux only in Fleet’s schema.
6+
query: |-
7+
SELECT
8+
usb_address,
9+
usb_port,
10+
vendor,
11+
vendor_id,
12+
model,
13+
model_id,
14+
serial,
15+
version
16+
FROM usb_devices
17+
WHERE vendor != '' OR model != '';
18+
interval: 86400
19+
observer_can_run: true
20+
automations_enabled: false
21+
logging: snapshot
22+
platform: darwin,linux

‎it-and-security/lib/linux/policies/sshd-permitrootlogin-restricted.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
- name: Linux - SSH PermitRootLogin not set to yes
2+
query: |-
3+
SELECT 1 WHERE NOT EXISTS (
4+
SELECT 1 FROM augeas
5+
WHERE (path = '/etc/ssh/sshd_config' OR path LIKE '/etc/ssh/sshd_config.d/%')
6+
AND label = 'PermitRootLogin'
7+
AND value IN ('yes', 'true', '1')
8+
);
9+
critical: false
10+
description: |-
11+
Passes if sshd_config (including any drop-in files in /etc/ssh/sshd_config.d/) does not set PermitRootLogin to yes (absent or set to no/prohibit-password/without-password is OK).
12+
Requires the augeas osquery table and augeas lenses on the host.
13+
resolution: |-
14+
Set `PermitRootLogin no` (or `prohibit-password`) in `/etc/ssh/sshd_config`, ensure no drop-in file in `/etc/ssh/sshd_config.d/` overrides it with `yes`, then restart `sshd`.
15+
16+
If you need help, please reach out in #help-it.
17+
platform: linux

‎it-and-security/lib/macos/policies/firewall-enabled.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
- name: macOS - Application firewall enabled
2+
query: SELECT 1 FROM alf WHERE global_state >= 1;
3+
critical: false
4+
description: |-
5+
Verifies the macOS Application Layer Firewall is on (global_state 1 = enabled, 2 = enabled blocking all inbound).
6+
resolution: |-
7+
Firewall should be automatically enforced by MDM. If this fails, restart the Mac and refetch in Fleet Desktop.
8+
If it still fails, drop a note in #help-it.
9+
platform: darwin

‎it-and-security/lib/macos/policies/gatekeeper-enabled.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
- name: macOS - Gatekeeper enabled
2+
query: SELECT 1 FROM gatekeeper WHERE assessments_enabled = 1;
3+
critical: false
4+
description: |-
5+
Verifies Gatekeeper is enabled so only trusted software runs.
6+
resolution: |-
7+
Gatekeeper should be automatically enforced by MDM. If this fails, restart the Mac and refetch in Fleet Desktop.
8+
If it still fails, drop a note in #help-it.
9+
platform: darwin

0 commit comments

Comments
 (0)