auditpolCIS

CIS Benchmark testing of Windows SIEM configuration.

This is an application for testing the configuration of Windows Audit Policy settings against the CIS Benchmark recommended settings.

Lots of organisations struggle with noisy Windows devices, especially if the SIEM vendor is charging by events volume. auditpolCIS points users in the direction of logging subcategories that can be disabled. We made an assessment of the security value of subcategories versus their noise volumes.

Note that CIS Benchmarks don't cover all categories that we can see from the auditpol command output. Where they do cover them, the CIS Benchmark recommendation applies. Where they do not cover (27 out of 59 tests), in most cases we have recommended a "No Auditing" setting.