hardening-windows-endpoint-with-cis-benchmark

name	hardening-windows-endpoint-with-cis-benchmark
description	Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Windows workstations or servers, remediating audit findings, or establishing organization-wide security baselines. Activates for requests involving Windows hardening, CIS benchmarks, GPO security baselines, or endpoint configuration compliance.
domain	cybersecurity
tags	["endpoint","hardening","windows-security","CIS-benchmark","GPO","baseline-configuration"]
subdomain	endpoint-security
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"]

Hardening Windows Endpoint With Cis Benchmark

Overview

Cybersecurity skill for hardening windows endpoint with cis benchmark. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "hardening windows endpoint with cis benchmark"
• "Deploying new Windows 10/11 or Server 2019/2022 endpoints that require security"
• "Establishing organization-wide security baselines using CIS Level 1 or Level 2 p"
• "Remediating findings from compliance audits (PCI DSS, HIPAA, SOC 2) that referen"

Use this skill when:

• Deploying new Windows 10/11 or Server 2019/2022 endpoints that require security hardening
• Establishing organization-wide security baselines using CIS Level 1 or Level 2 profiles
• Remediating findings from compliance audits (PCI DSS, HIPAA, SOC 2) that reference CIS benchmarks
• Validating existing endpoint configurations against current CIS benchmark versions

Do not use this skill for Linux endpoints (use hardening-linux-endpoint-with-cis-benchmark) or for cloud-native workloads that require CIS cloud benchmarks.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Windows 10/11 Enterprise or Windows Server 2019/2022 target endpoints
• Active Directory Group Policy Management Console (GPMC) for enterprise deployment
• CIS-CAT Pro Assessor or CIS-CAT Lite for automated benchmark assessment
• Administrative access to target endpoints or domain controller
• Current CIS Benchmark PDF for the target Windows version (download from cisecurity.org)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: ) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}