@cyberstrike-io/cyberstrike 1.1.6-beta.8 → 1.1.10-beta.1

package/package.json

@@ -7,7 +7,7 @@
   "scripts": {
     "postinstall": "bun ./postinstall.mjs || node ./postinstall.mjs"
   },
-  "version": "1.1.6-beta.8",
+  "version": "1.1.10-beta.1",
   "license": "AGPL-3.0-only",
   "keywords": [
     "cyberstrike",
@@ -37,6 +37,6 @@
     "url": "https://github.com/CyberStrikeus/CyberStrike.git"
   },
   "optionalDependencies": {
-    "@cyberstrike-io/cyberstrike-darwin-arm64": "1.1.6-beta.8"
+    "@cyberstrike-io/cyberstrike-darwin-arm64": "1.1.10-beta.1"
   }
 }

package/postinstall.mjs

@@ -133,6 +133,22 @@ function installWebUI() {
   console.log(`Web UI installed to ${webDest}`)
 }
 
+function installSkills() {
+  const skillSrc = path.join(__dirname, "skill")
+  if (!fs.existsSync(skillSrc)) return
+
+  const dataDir = path.join(xdgDataDir(), "cyberstrike")
+  const skillDest = path.join(dataDir, "skill")
+
+  // Remove old skills before copying
+  if (fs.existsSync(skillDest)) {
+    fs.rmSync(skillDest, { recursive: true, force: true })
+  }
+
+  copyDirSync(skillSrc, skillDest)
+  console.log(`Skills installed to ${skillDest}`)
+}
+
 async function main() {
   try {
     if (os.platform() === "win32") {
@@ -140,6 +156,7 @@ async function main() {
       // No postinstall setup needed
       console.log("Windows detected: binary setup not needed (using packaged .exe)")
       installWebUI()
+      installSkills()
       return
     }
 
@@ -150,6 +167,7 @@ async function main() {
     console.log("Wrapper script will handle binary execution")
 
     installWebUI()
+    installSkills()
   } catch (error) {
     console.error("Failed to setup cyberstrike binary:", error.message)
     process.exit(1)

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-10.1/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: cis-aws-compute-10.1
+description: "Ensure Managed Platform updates is configured"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, elastic-beanstalk, managed-updates, patching, platform]
+cis_id: "10.1"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-10.2, cis-aws-compute-10.3, cis-aws-compute-10.4]
+prerequisites: []
+severity_boost: {}
+---
+
+# 10.1 Ensure Managed Platform updates is configured (Manual)
+
+## Description
+
+AWS Elastic Beanstalk regularly releases platform updates to provide fixes, software updates, and new features. With managed platform updates, you can configure your environment to automatically upgrade to the latest version of a platform during a scheduled maintenance window.
+
+## Rationale
+
+Your application remains in service during the update process with no reduction in capacity. Managed updates are available on both single-instance and load-balanced environments. They also ensure you aren't introducing any vulnerabilities by running legacy systems that require updates and patches.
+
+## Impact
+
+N/A
+
+## Audit Procedure
+
+### Using AWS Console
+
+1. Login to AWS Console using https://console.aws.amazon.com/elasticbeanstalk
+2. On the left hand side click `Environments`
+3. Click on the `Environment name` that you want to review
+4. Under the `environment_name-env` in the left column click `Configuration`
+5. Scroll down under Configurations
+6. Under category look for `Managed updates`
+7. Confirm `Managed updates: enabled`
+8. If status options reads `Managed updates: disabled` refer to the remediation below.
+9. Repeat steps 3-8 for each environment within the current region.
+10. Then repeat the Audit process for all other regions.
+
+### Using AWS CLI
+
+N/A - This control is manual and console-based.
+
+## Expected Result
+
+`Managed updates: enabled` is displayed under the Managed updates category in the environment Configuration.
+
+## Remediation
+
+### Using AWS Console
+
+1. Login to AWS Console using https://console.aws.amazon.com/elasticbeanstalk
+2. On the left hand side click `Environments`
+3. Click on the `Environment name` that you want to update
+4. Under the `environment_name-env` in the left column click `Configuration`
+5. Scroll down under Configurations
+6. Under category look for `Managed updates`
+7. Click on Edit
+8. On the Managed Platform Updates page:
+
+```
+Managed updates - click the Enable checkbox
+Weekly update window - set preferred maintenance window
+Update level- set it to Minor and patch
+Instance replacement - click the Enabled checkbox
+```
+
+9. Click Apply
+10. Repeat steps 3-8 for each environment within the current region that needs Managed updates set.
+11. Then repeat the remediation process for all other regions identified in the Audit.
+
+### Using AWS CLI
+
+N/A - This control is manual and console-based.
+
+## Default Value
+
+Managed platform updates are not enabled by default.
+
+## References
+
+1. https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/environment-platform-update-managed.html
+
+## CIS Controls
+
+| Controls Version | Control                                              | IG 1 | IG 2 | IG 3 |
+| ---------------- | ---------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 7.4 Perform Automated Application Patch Management   | X    | X    | X    |
+| v7               | 3.5 Deploy Automated Software Patch Management Tools | X    | X    | X    |
+
+## Profile
+
+Level 1 | Manual

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-10.2/SKILL.md

@@ -0,0 +1,98 @@
+---
+name: cis-aws-compute-10.2
+description: "Ensure Persistent logs is setup and configured to S3"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, elastic-beanstalk, logging, cloudwatch, s3, monitoring]
+cis_id: "10.2"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-10.1, cis-aws-compute-10.3, cis-aws-compute-10.4]
+prerequisites: []
+severity_boost: {}
+---
+
+# 10.2 Ensure Persistent logs is setup and configured to S3 (Manual)
+
+## Description
+
+Elastic Beanstalk can be configured to automatically stream logs to the CloudWatch service.
+
+## Rationale
+
+With CloudWatch Logs, you can monitor and archive your Elastic Beanstalk application, system, and custom log files from Amazon EC2 instances of your environments.
+
+## Impact
+
+N/A
+
+## Audit Procedure
+
+### Using AWS Console
+
+1. Login to AWS Console using https://console.aws.amazon.com/elasticbeanstalk
+2. On the left hand side click `Environments`
+3. Click on the `Environment name` that you want to review
+4. Under the `environment_name-env` in the left column click `Configuration`
+5. Scroll down under Configurations
+6. Under category look for `Softwares`
+7. Confirm `Log streaming: enabled`
+8. If status options reads `Log streaming: disabled` refer to the remediation below.
+9. Repeat steps 3-8 for each environment within the current region.
+10. Then repeat the Audit process for all other regions.
+
+### Using AWS CLI
+
+N/A - This control is manual and console-based.
+
+## Expected Result
+
+`Log streaming: enabled` is displayed under the Softwares category in the environment Configuration.
+
+## Remediation
+
+### Using AWS Console
+
+1. Login to AWS Console using https://console.aws.amazon.com/elasticbeanstalk
+2. On the left hand side click `Environments`
+3. Click on the `Environment name` that you want to update
+4. Under the `environment_name-env` in the left column click `Configuration`
+5. Scroll down under Configurations
+6. Under category look for `Software`
+7. Click on Edit
+8. On the Modify software page:
+
+```
+Instance log streaming to CloudWatch Logs
+Log streaming - click the Enabled checkbox
+Set the required retention based on Organization requirements
+Lifecycle - Keep logs after terminating environment
+```
+
+9. Click Apply
+10. Repeat steps 3-8 for each environment within the current region that needs Managed updates set.
+
+### Using AWS CLI
+
+N/A - This control is manual and console-based.
+
+## Default Value
+
+Log streaming to CloudWatch is not enabled by default.
+
+## References
+
+1. https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.cloudwatchlogs.html
+
+## CIS Controls
+
+| Controls Version | Control                    | IG 1 | IG 2 | IG 3 |
+| ---------------- | -------------------------- | ---- | ---- | ---- |
+| v8               | 8.2 Collect Audit Logs     | X    | X    | X    |
+| v7               | 6.2 Activate audit logging | X    | X    | X    |
+
+## Profile
+
+Level 1 | Manual

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-10.3/SKILL.md

@@ -0,0 +1,104 @@
+---
+name: cis-aws-compute-10.3
+description: "Ensure access logs are enabled"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, elastic-beanstalk, access-logs, load-balancer, logging]
+cis_id: "10.3"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-10.1, cis-aws-compute-10.2, cis-aws-compute-10.4]
+prerequisites: []
+severity_boost: {}
+---
+
+# 10.3 Ensure access logs are enabled (Manual)
+
+## Description
+
+When you enable load balancing, your AWS Elastic Beanstalk environment is equipped with an Elastic Load Balancing load balancer to distribute traffic among the instances in your environment.
+
+## Rationale
+
+For security reasons it is important to have a record of all the access logs and this is enabled within the Load Balancer assigned to the Elastic Beanstalk environments.
+
+## Impact
+
+N/A
+
+## Audit Procedure
+
+### Using AWS Console
+
+1. Login to AWS Console using https://console.aws.amazon.com/ec2
+2. On the left hand scroll down to Load Balancing and click on `Load Balancers`
+3. Click on the Load balancer associated with the Elastic Beanstalk Environment
+
+```
+Typically they have AWSEB in the name.
+If you utilized Elastic Beanstalk to create the Load balancer the Source
+Security Group listed in the Description will reference `Elastic Beanstalk`
+```
+
+4. Under the `Description` tab scroll down to the `Attributes` section
+5. Confirm `Access logs` is set to Enabled.
+6. If status options reads `Disabled` refer to the remediation below.
+7. Repeat steps 3-8 for each environment within the current region.
+8. Then repeat the Audit process for all other regions.
+
+### Using AWS CLI
+
+N/A - This control is manual and console-based.
+
+## Expected Result
+
+`Access logs` is set to Enabled under the Attributes section on the Load Balancer Description tab.
+
+## Remediation
+
+### Using AWS Console
+
+1. Login to AWS Console using https://console.aws.amazon.com/ec2
+2. On the left hand scroll down to Load Balancing and click on `Load Balancers`
+3. Click on the Load balancer associated with the Elastic Beanstalk Environment
+
+```
+Typically they have AWSEB in the name.
+If you utilized Elastic Beanstalk to create the Load balancer the Source
+Security Group listed in the Description will reference `Elastic Beanstalk~`
+```
+
+4. Under the `Description` tab scroll down to the `Attributes` section
+5. Under Access logs - Disabled click on Configure access logs.
+6. Click the check box next to `Enable access logs`.
+7. Enter the S3 bucket name you have setup for the Elastic Beanstalk access logs.
+   \*\*Note - if you don't have a S3 bucket already created enter an organization name in accordance with policy and have it identify with Elastic Beanstalk. Then click the check box next to `Create this location for me`
+8. Click `Save`
+9. Scroll down under the description tab and confirm that the Access logs are set as described above.
+10. Repeat steps 3-11 for each Load balancer created and used with Elastic Beanstalk environment within the current region.
+11. Then repeat the remediation process for all other regions identified in the Audit.
+
+### Using AWS CLI
+
+N/A - This control is manual and console-based.
+
+## Default Value
+
+Access logs are disabled by default on Load Balancers.
+
+## References
+
+1. https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.managing.elb.html
+
+## CIS Controls
+
+| Controls Version | Control                    | IG 1 | IG 2 | IG 3 |
+| ---------------- | -------------------------- | ---- | ---- | ---- |
+| v8               | 8.2 Collect Audit Logs     | X    | X    | X    |
+| v7               | 6.2 Activate audit logging | X    | X    | X    |
+
+## Profile
+
+Level 1 | Manual

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-10.4/SKILL.md

@@ -0,0 +1,105 @@
+---
+name: cis-aws-compute-10.4
+description: "Ensure that HTTPS is enabled on load balancer"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, elastic-beanstalk, https, tls, load-balancer, encryption]
+cis_id: "10.4"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-10.1, cis-aws-compute-10.2, cis-aws-compute-10.3]
+prerequisites: []
+severity_boost: {}
+---
+
+# 10.4 Ensure that HTTPS is enabled on load balancer (Manual)
+
+## Description
+
+The simplest way to use HTTPS with an Elastic Beanstalk environment is to assign a server certificate to your environment's load balancer.
+
+## Rationale
+
+When you configure your load balancer to terminate HTTPS, the connection between the client and the load balancer is secure.
+
+## Impact
+
+N/A
+
+## Audit Procedure
+
+### Using AWS Console
+
+1. Login to AWS Console using https://console.aws.amazon.com/elasticbeanstalk
+2. On the left hand side click `Environments`
+3. Click on the `Environment name` that you want to review
+4. Under the "environment_name-env" click `Configuration`
+5. Scroll down under Configurations
+6. Under category look for `Load balancer`
+7. Click `Edit`
+8. Under the `Listeners` section
+9. Check the Listeners section for any enabled listeners and make sure the Protocol is set to HTTPS and Enabled.
+10. If the Listener is required for HTTP and is not set to HTTPS refer to the remediation below.
+11. Repeat steps 3-10 for each environment within the current region.
+12. Then repeat the Audit process for all other regions.
+
+### Using AWS CLI
+
+N/A - This control is manual and console-based.
+
+## Expected Result
+
+All enabled Listeners under the Load balancer configuration have their Protocol set to HTTPS and are Enabled.
+
+## Remediation
+
+### Using AWS Console
+
+1. Login to AWS Console using https://console.aws.amazon.com/elasticbeanstalk
+2. On the left hand side click `Environments`
+3. Click on the `Environment name` that you want to review
+4. Under the "environment_name-env" click `Configuration`
+5. Scroll down under Configurations
+6. Under category look for `Load balancer`
+7. Click `Edit`
+8. Under the `Listeners` section
+9. Click `Add listener`
+
+```
+Set listener port
+Set Listener protocol to HTTPS
+Set Instance Port
+Sent Instance protocol to HTTPS
+Select your SSL certificate
+```
+
+10. Click `Add`
+11. Make sure it is listed as enabled. If you have other listeners not using HTTPS make sure to turn off enabled
+12. Click `Apply` to save the configuration changes.
+13. Repeat steps 3-12 for each environment within the current region.
+14. Then repeat the remediation for all other regions.
+
+### Using AWS CLI
+
+N/A - This control is manual and console-based.
+
+## Default Value
+
+HTTPS is not configured on Elastic Beanstalk load balancers by default.
+
+## References
+
+1. https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https.html
+
+## CIS Controls
+
+| Controls Version | Control                                           | IG 1 | IG 2 | IG 3 |
+| ---------------- | ------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 3.10 Encrypt Sensitive Data in Transit            |      | X    | X    |
+| v7               | 14.4 Encrypt All Sensitive Information in Transit |      | X    | X    |
+
+## Profile
+
+Level 1 | Manual

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-11.1/SKILL.md

@@ -0,0 +1,100 @@
+---
+name: cis-aws-compute-11.1
+description: "Ensure customer-managed keys are used to encrypt AWS Fargate ephemeral storage data for Amazon ECS"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, fargate, ecs, kms, encryption, ephemeral-storage]
+cis_id: "11.1"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: []
+prerequisites: []
+severity_boost: {}
+---
+
+# 11.1 Ensure customer-managed keys are used to encrypt AWS Fargate ephemeral storage data for Amazon ECS (Automated)
+
+## Description
+
+Use customer-managed AWS KMS keys to encrypt AWS Fargate ephemeral storage data for on Amazon ECS, ensuring that sensitive data remains protected during task execution.
+
+## Rationale
+
+Customer-managed KMS keys offer enhanced control over encryption, including key rotation, access policies, and audit trails.
+
+## Impact
+
+There are costs and configuration overhead associated with setting up and managing customer-managed keys.
+
+## Audit Procedure
+
+### Using AWS Console
+
+1. Login to the ECS console using https://console.aws.amazon.com/ecs/.
+2. In the left panel, click `Clusters`.
+3. Click the name of a cluster.
+4. Ensure that `Fargate ephemeral storage` is not set to `-`.
+5. Repeat steps 1-4 for each ECS cluster.
+
+### Using AWS CLI
+
+Run the following command to list clusters:
+
+```bash
+aws ecs list-clusters
+```
+
+Run the following command to view the Fargate ephemeral storage KMS key ID configured for a cluster:
+
+```bash
+aws ecs describe-clusters --clusters <cluster-arn> --include CONFIGURATIONS --query 'clusters[*].configuration.managedStorageConfiguration.fargateEphemeralStorageKmsKeyId'
+```
+
+Ensure the command returns a customer-managed KMS key ARN.
+Repeat for each cluster.
+
+## Expected Result
+
+Each ECS cluster returns a valid customer-managed KMS key ARN for the Fargate ephemeral storage configuration, rather than `-` or empty.
+
+## Remediation
+
+### Using AWS Console
+
+1. Login to the ECS console using https://console.aws.amazon.com/ecs/.
+2. In the left panel, click `Clusters`.
+3. Click the name of a cluster.
+4. Click `Update cluster`.
+5. Expand the `Encryption` section.
+6. Under `Fargate ephemeral storage`, select a customer-managed KMS key.
+   Note: Ensure the KMS key has appropriate Fargate service permissions.
+7. Click `Update`.
+8. Repeat steps 1-7 for each ECS cluster requiring remediation.
+
+### Using AWS CLI
+
+N/A - Remediation is console-based for this control.
+
+## Default Value
+
+AWS Fargate ephemeral storage data is encrypted by default.
+
+## References
+
+1. https://docs.aws.amazon.com/AmazonECS/latest/developerguide/fargate-storage-encryption.html
+2. https://docs.aws.amazon.com/AmazonECS/latest/developerguide/fargate-create-storage-key.html
+3. https://awscli.amazonaws.com/v2/documentation/api/2.0.33/reference/ecs/list-clusters.html
+4. https://awscli.amazonaws.com/v2/documentation/api/2.0.33/reference/ecs/describe-clusters.html
+
+## CIS Controls
+
+| Controls Version | Control                                    | IG 1 | IG 2 | IG 3 |
+| ---------------- | ------------------------------------------ | ---- | ---- | ---- |
+| v8               | 3.11 Encrypt Sensitive Data at Rest        |      | X    | X    |
+| v7               | 14.8 Encrypt Sensitive Information at Rest |      |      | X    |
+
+## Profile
+
+Level 2 | Automated

package/skill/CIS_benchmarks/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-12.1/SKILL.md

@@ -0,0 +1,100 @@
+---
+name: cis-aws-compute-12.1
+description: "Ensure AWS Config is Enabled for Lambda and Serverless"
+category: cis-compute
+version: "1.1.0"
+author: cyberstrike-official
+tags: [cis, aws, compute, lambda, serverless, config, compliance, monitoring]
+cis_id: "12.1"
+cis_benchmark: "CIS AWS Compute Services Benchmark v1.1.0"
+tech_stack: [aws]
+cwe_ids: []
+chains_with: [cis-aws-compute-12.2, cis-aws-compute-12.7]
+prerequisites: []
+severity_boost: {}
+---
+
+# Ensure AWS Config is Enabled for Lambda and Serverless
+
+## Description
+
+With AWS Config, you can track configuration changes to the Lambda functions (including deleted functions), runtime environments, tags, handler name, code size, memory allocation, timeout settings, and concurrency settings, along with Lambda IAM execution role, subnet, and security group associations.
+
+## Rationale
+
+This gives you a holistic view of the Lambda function's lifecycle and enables you to surface that data for potential audit and compliance requirements.
+
+## Impact
+
+Enabling AWS Config for Lambda may incur additional AWS Config costs depending on the number of configuration items recorded and the number of active rules.
+
+## Audit Procedure
+
+### Using AWS Console
+
+1. Login to AWS Console using https://console.aws.amazon.com
+2. Click `All services`, click `Config` under Management & Governance.
+3. This will open up the Config dashboard.
+4. Click `Conformance packs`
+5. Review the list of conformance packs.
+6. If `serverless` is listed or included in the conformance pack you built you meet this recommendation.
+7. If `serverless` is not listed refer to the remediation below.
+8. If none, see remediation section below.
+9. Repeat steps 3-7 for all regions used.
+
+### Using AWS CLI
+
+N/A - This control is Console-based audit only.
+
+## Expected Result
+
+AWS Config conformance packs include `serverless` and Lambda security conformance packs for all regions in use.
+
+## Remediation
+
+### Using AWS Console
+
+1. Login to AWS Console using https://console.aws.amazon.com
+2. Click `All services`, click `Config` under Management & Governance.
+3. This will open up the Config dashboard.
+4. Click `Conformance packs`
+5. Click on `Deploy conformance pack`
+6. Click on `Use sample template`
+7. Click the down arrow under Sample template
+8. Scroll down and click on Operational Best Practices for Serverless
+9. Click Next
+10. Give it a Conformance pack name `Serverless`.
+11. Click Next
+12. Click `Deploy conformance pack`
+13. Click on `Deploy conformance pack`
+14. Click on `Use sample template`
+15. Click the down arrow under Sample template
+16. Scroll down and click on Security Best Practices for Lambda
+17. Click Next
+18. Give it a Conformance pack name `LambaSecurity`.
+19. Click Next
+20. Click `Deploy conformance pack`
+21. Repeat steps 2-20 for all regions used.
+
+### Using AWS CLI
+
+N/A - This control is Console-based remediation only.
+
+## Default Value
+
+AWS Config is not enabled by default for Lambda and Serverless.
+
+## References
+
+1. https://docs.aws.amazon.com/lambda/latest/dg/welcome.html
+
+## CIS Controls
+
+| Controls Version | Control                                                                                                                                                         | IG 1 | IG 2 | IG 3 |
+| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | ---- | ---- |
+| v8               | 8.2 Collect Audit Logs - Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets. | x    | x    | x    |
+| v7               | 6.2 Activate audit logging - Ensure that local logging has been enabled on all systems and networking devices.                                                  | x    | x    | x    |
+
+## Profile
+
+Level 2 | Manual