Формат правил
Как устроено YAML-правило и как написать собственное.
Pages that are not translated into your language yet are shown in English. Commands and file formats are the same in every language.
Rules are plain YAML files under rules/. One file describes one control: what to check and how to fix it.
Example
yaml
id: "CIS-UBUNTU-5.2.8"
title: "Ensure SSH root login is disabled"
description: "The PermitRootLogin parameter specifies if the root user can log in using ssh."
target: "linux"
os_family: ["ubuntu-22.04", "ubuntu-24.04", "rocky-9"]
level: 1
severity: "high"
tags: ["ssh", "server"]
audit:
type: "file_regex"
file_path: "/etc/ssh/sshd_config"
pattern: '(?m)^\s*PermitRootLogin\s+no\b'
remediation:
type: "command"
command: "sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config"
verify_cmd: "sshd -t"
backup_files: ["/etc/ssh/sshd_config"]Fields
| Field | Meaning |
|---|---|
id | Unique identifier |
title, description | What the control is, in English |
target | Platform, for example linux, windows, postgres, aws |
os_family | Optional list restricting the rule to operating systems |
level | CIS profile level, 1 or 2 |
severity | critical, high, medium or low |
tags, reference | Search tags and the benchmark section to verify against |
audit | How to check |
remediation | How to fix |
Audit types
| Type | What it does |
|---|---|
command | Runs a command and compares output with expected_output |
file_regex | Matches a pattern against a file; must_not_match inverts it |
config_regex | Matches a pattern against an exported device configuration |
sql_query | Runs a database query |
registry | Reads a Windows registry value |
cloud_check | Calls a cloud API through the SDK |
manual | Cannot be automated; shown with instructions |
Remediation types
| Type | What it does |
|---|---|
command | Runs a command; verify_cmd validates the result and backup_files are snapshotted first |
file_line | Replaces a line that matches match_regex in a file with replace_line |
sql_exec | Runs a SQL statement |
iac_patch | Guidance or an infrastructure-as-code patch; never applied automatically |
Rules derived from CIS Benchmarks stay under CIS's own terms. Do not add text copied from benchmark PDFs beyond what the rule needs.
Browse the catalog
The rule explorer on this site lists every rule. tmaegis rules export produces the same catalog as JSON.