Baseline
CIS / MLPS 2.0 compliance verdicts as rules over osquery results. No model involved; reproducible and usable air-gapped.
Baseline answers "are the SSH config, password policy and audit switches on these 40 hosts compliant". Each rule = one osquery SQL collection + one judge operator; verdicts are deterministic and spend no model quota. Every edition.
Onboarding (first time)
With no runs yet the page shows the setup steps:
Create the indices
The gateway creates three: rules baseline-rules, results baseline-results, runs baseline-runs (renamable via RST_BASELINE_*_INDEX).
Import the rules
Import the built-in library (127 rules covering common MLPS 2.0 and CIS items for Linux / Windows); view and edit them on the Rules tab.
Deploy osquery
Install osquery on the target hosts and run the library's collection queries as a pack on a schedule; ship results to ES with Fleet (Osquery Manager) / Filebeat / Logstash. The gateway reads logs-osquery_manager.result-* by default (RST_BASELINE_OSQUERY_INDEX).
Check the field mapping
"osquery field check" at the top shows the host field, rule key and column prefix the gateway inferred. Self-managed ELK stacks often differ; override with RST_BASELINE_* variables.
Run
Once data is flowing, click "Run now"; every rule is judged per host. For a schedule set RST_BASELINE_INTERVAL_SECONDS (≥ 300; match the osquery pack interval, e.g. 86400).
Results
Four cards on top: compliance score (hosts × rules), passed, failed (configuration to fix), manual / error (not counted). The score's denominator is passed + failed only.
Below: score trend across runs, this run's verdict mix, per-host scores, and the result table: host / rule / category / severity / verdict / observed. Click a row for expected value, observed value, remediation and standard references (e.g. MLPS2.0-8.1.4.2, CIS-5.4.1).
osquery results older than 48 hours (RST_BASELINE_MAX_AGE_HOURS) are stale and never judged pass / fail; hosts silent for 30 days (RST_BASELINE_HOST_ROSTER_DAYS) drop out of the roster.
Rules
Each rule: ID, title, platform (linux / windows / any), judge operator, enabled, source (built-in / custom). Filter by ID / title / category; disable what you do not need.
New / edit rule
| Field | Notes |
|---|---|
| Rule ID | 3–64 chars [A-Za-z0-9._-]; also the query name in the osquery pack |
| Collection query | osquery SQL, e.g. SELECT value FROM ... WHERE key='PermitRootLogin' |
| Judge field / operator / expected | Which column of the result, how to compare (equals / contains / regex / numeric), what is expected |
| On missing field | Pass, fail or manual when the result lacks the field |
| Remediation template | Shown on failure, e.g. "edit /etc/ssh/sshd_config, set PermitRootLogin no" |
| Standard references | Comma-separated, shown verbatim |
History
The History tab lists every run: finished at, score, passed / failed, hosts × rules; open one for its full results. Reports cite the period's pass rate.