Baseline checks
CIS and MLPS 2.0 compliance verdicts from rules over osquery results. No model involved, so verdicts are reproducible and work air-gapped.
Baseline checks judges host settings such as SSH configuration, password policy, and audit switches against compliance rules. Each rule is one osquery SQL collection query plus one judge operator. Verdicts are deterministic and make no model calls. Available in every edition.
At startup the gateway creates the baseline indices (baseline-rules, baseline-results, baseline-runs). If the rule library is empty, it loads the 127 built-in rules, which cover common MLPS 2.0 and CIS items for Linux and Windows. A library that already holds rules is left alone.
Onboard osquery data
Until the first run, the page offers Show the setup steps.
Steps
- Install osquery on the target hosts and schedule the collection queries from Rules as a pack. Each query name in the pack is the rule ID.
- Ship the results to Elasticsearch with Fleet (Osquery Manager), Filebeat, or Logstash. The gateway reads
logs-osquery_manager.result-*by default. - In osquery field check at the top of the page, verify the host field, rule key, and column prefix the gateway inferred. If they do not match your data, override them with environment variables (see Configuration). Self-managed ELK stacks often use different index names and field prefixes.
- Select Run now.
The gateway judges every rule per host and shows the verdicts under Results. For scheduled runs, set RST_BASELINE_INTERVAL_SECONDS to 300 or more, ideally the osquery pack interval, for example 86400.
Results
| Card | Meaning |
|---|---|
| Compliance score | Pass divided by pass plus fail, over host and rule combinations |
| Pass | Combinations that passed |
| Fail | Combinations whose configuration needs changing |
| Manual review / error | Not counted in the score |
Below the cards are Compliance score over time, Verdict mix, Per-host compliance, and the result table. Select a row for Expected, Observed, Remediation, and the standard references, for example CIS-5.4.1.
The gateway reads host.os.* from each host's results to find its platform and runs only the rules for that platform plus the rules for any platform. A host that reports no host.os.* runs every rule. Results older than RST_BASELINE_MAX_AGE_HOURS (48 hours by default) are stale and never judged pass or fail.
Rules
Each rule on Rules has a rule ID, title, platform, judge operator, enabled state, and source (built-in or custom). Filter by ID, title, or category, and disable rules that do not apply. With the interface in English, built-in rules show English titles, categories, standard references, and remediation. Rules you wrote or edited show as entered.
Create a rule
On Rules, select New rule and fill in the fields below.
| Field | Description |
|---|---|
| Rule ID | 3 to 64 characters from [A-Za-z0-9._-]. Also the query name in the osquery pack |
| Platform | linux or windows; empty means any |
| Collection query (osquery SQL) | For example SELECT value FROM ... WHERE key='PermitRootLogin' |
| Judged field (judge.field), Judge operator, Expected value (judge.expected) | Which result column to judge, how to compare it (equals, contains, regex, numeric), and the expected value |
| Verdict when the field is missing (judge.on_missing) | Pass, fail, or manual review when the result lacks the field |
| Remediation template | Shown on failure, for example "Edit /etc/ssh/sshd_config and set PermitRootLogin no" |
| Standard references (comma-separated) | Shown as entered in results and reports |
History
History lists each run with finish time, score, pass and fail counts, and host and rule counts. Select a run for its full results. Reports cite the pass rate for the report period.
Configuration
| Variable | Default | Description |
|---|---|---|
RST_BASELINE_OSQUERY_INDEX | logs-osquery_manager.result-* | osquery results index to read |
RST_BASELINE_RULES_INDEX | baseline-rules | Rule library index |
RST_BASELINE_RESULTS_INDEX | baseline-results | Verdict index |
RST_BASELINE_RUNS_INDEX | baseline-runs | Run index |
RST_BASELINE_HOST_FIELD | inferred | Host identity field |
RST_BASELINE_QUERY_FIELD | inferred | Query name field, matched to the rule ID |
RST_BASELINE_COL_PREFIX | inferred | Result column prefix, for example osquery. |
RST_BASELINE_INTERVAL_SECONDS | unset | Scheduled run interval in seconds, 300 or more. Unset or below 300 means no scheduled runs |
RST_BASELINE_MAX_AGE_HOURS | 48 | Results older than this are stale |
RST_BASELINE_HOST_ROSTER_DAYS | 30 | Hosts silent for longer are no longer checked |