content

by ComplianceAsCode

2.6Kstars

765forks

120watchers

Updated 3 months ago

About

ComplianceAsCode/content provides automated security policy content and compliance checks in multiple formats to help organizations enforce and audit security baselines across various platforms.

Security automation content in SCAP, Bash, Ansible, and other formats

Primary Use Case

This tool is used by security teams and system administrators to automate compliance auditing and remediation across Linux distributions and software products. It enables organizations to assess risk and enforce security policies consistently using SCAP, Ansible, and Bash formats. It is ideal for governance, risk, and compliance (GRC) workflows requiring scalable and maintainable security content.

Key Features

Provides security policy content for multiple platforms including RHEL, Fedora, Ubuntu, Debian, and SLES
Supports multiple output formats: SCAP (XCCDF, OVAL), Ansible playbooks, and Bash scripts
Enables both compliance auditing and automated remediation
Uses an OpenControl-inspired YAML rule format for easy creation and maintenance of security content
Includes a powerful build system to generate consistent content across formats
Integrates security identifiers like CCE, NIST ID, and STIG in all output formats
Publishes Ansible content on Ansible Galaxy and releases ZIP archives
Offers online documentation, workshops, and profile guides

Installation

Clone the repository from GitHub: git clone https://github.com/ComplianceAsCode/content.git
Navigate to the cloned directory: cd content
Refer to the online documentation for build and usage instructions: https://complianceascode.readthedocs.io/
Download release ZIP archives from the GitHub releases page for prebuilt content
Use Ansible Galaxy to install Ansible playbooks if preferred

Usage

>_ Run Ansible playbooks in check mode

Evaluate system compliance without making changes

>_ Run Ansible playbooks in run mode

Apply security fixes to bring systems into compliance

>_ Execute Bash fix scripts

Apply compliance fixes directly on systems when other automation is not available

Security Frameworks

Reconnaissance

Defense Evasion

Discovery

Collection

Impact

Usage Insights

Integrate ComplianceAsCode content into CI/CD pipelines to automate compliance checks and remediation before deployment.
Leverage Ansible playbooks for rapid and consistent remediation across heterogeneous Linux environments.
Use SCAP content for continuous compliance auditing to detect drift from security baselines in production.
Combine with vulnerability management tools to prioritize remediation based on compliance status.
Employ the tool in purple team exercises to validate detection and response capabilities against compliance violations.