Automatic CIS Benchmark scan of Windows Servers through Sentinel.

Question

Hello!

In my job, we regularly use the CIS Benchmark to test Windows Servers from 2012-2022. We have been receiving this from a vendor who automatically runs the checks through Qualys and then presented in a dashboard.

Now we are transitioning to Microsoft Sentinel and I'm wondering if there is a functionality in Sentinel that allows for automated testing of CIS Benchmark on Windows Servers?

Answer 1

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query

Microsoft Sentinel is a Security Information and Event Management (SIEM) solution, and it doesn't have a built-in capability to automate CIS Benchmark testing on Windows Servers. However, you can use Microsoft Azure Security Center to automate CIS Benchmark testing on Windows Servers. Azure Security Center provides a CIS Benchmark scanning solution that scans the configuration of your Windows Server against the corresponding CIS Benchmark profile, and generates a report of findings. You can also configure Azure Security Center to trigger alerts when there are deviations from the benchmark profile.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.