CIS to Fleet

A little bash script for converting CIS benchmarks to Fleet-compatible policy files.

Convert Center for Internet Security (CIS) benchmark policies from the Fleet repository into clean, Fleet-ready YAML files for streamlined security compliance management.

Quick Start

# 1. Download and make executable
curl -O https://raw.githubusercontent.com/tux234/cis-to-fleet/canonical/bash-implementation/cis-to-fleet.sh
chmod +x cis-to-fleet.sh

# 2. Install dependencies (if needed)
brew install curl jq yq  # macOS with Homebrew

# 3. Generate Fleet policies
./cis-to-fleet.sh list                           # Show available platforms  
./cis-to-fleet.sh generate macos-15 gitops       # GitOps YAML array
./cis-to-fleet.sh generate win-11 fleetctl split # Individual fleetctl files

Dependencies

This script requires three system tools:

Tool	Purpose	Installation
`curl`	HTTP requests to GitHub API	Usually pre-installed
`jq`	JSON processing and filtering	`brew install jq`
`yq`	YAML processing and generation	`brew install yq`

Platform-Specific Installation

macOS (Homebrew):

brew install curl jq yq

Ubuntu/Debian:

sudo apt update && sudo apt install curl jq
sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
sudo chmod +x /usr/local/bin/yq

RHEL/CentOS/Fedora:

sudo yum install curl jq  # or dnf install
sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
sudo chmod +x /usr/local/bin/yq

Usage

Command Structure

./cis-to-fleet.sh <command> [options] [arguments]

Available Commands

`list` - Show Available Platforms

./cis-to-fleet.sh list [--verbose] [--help]

Examples:

./cis-to-fleet.sh list                    # Show all platforms
./cis-to-fleet.sh list --verbose          # Show with debug info

`generate` - Create Fleet Policy Files

./cis-to-fleet.sh generate [platforms...] <format> [split] [options]

Arguments:

platforms - One or more platform names (or --all for all platforms)
format - Output format: gitops or fleetctl
split - Optional modifier to create individual files per policy

Options:

-a, --all - Process all available platforms
-l, --level <level> - CIS compliance level: 1, 2, or all (default: all)
-o, --output <dir> - Output directory (default: ./output)
-f, --force - Overwrite existing files without prompting
-v, --verbose - Enable detailed logging
-h, --help - Show command help

Usage Examples

Basic Operations:

# List available CIS benchmark platforms
./cis-to-fleet.sh list

# Generate GitOps format for macOS 15
./cis-to-fleet.sh generate macos-15 gitops

# Generate Fleetctl format for Windows 11
./cis-to-fleet.sh generate win-11 fleetctl

Individual Policy Files:

# Create individual GitOps files (one per policy)
./cis-to-fleet.sh generate macos-15 gitops split

# Create individual Fleetctl files for multiple platforms  
./cis-to-fleet.sh generate win-10 win-11 fleetctl split

Advanced Usage:

# All platforms, Level 1 policies only, custom output
./cis-to-fleet.sh generate --all gitops --level 1 --output /tmp/policies

# Multiple platforms, Level 2, force overwrite, verbose logging
./cis-to-fleet.sh generate macos-14 macos-15 fleetctl --level 2 --force --verbose

Output Formats

GitOps Format (`gitops`)

Purpose: Optimized for GitOps workflows and Fleet's "separate file" configuration.

Structure: YAML array with field ordering optimized for readability

- name: Policy Name
  platform: darwin
  description: |
    Multi-line policy description
    with proper formatting
  resolution: |
    Step-by-step resolution
    instructions
  query: SELECT * FROM table WHERE condition;

File Output:

Combined: output/cis-benchmark-macos15-gitops.yml
Split: output/macos-15-gitops/Policy_Name.yml (each wrapped in array)

Fleetctl Format (`fleetctl`)

Purpose: Ready for direct deployment with fleetctl apply command.

Structure: Kubernetes-style YAML documents with proper Fleet schema

apiVersion: v1
kind: policy
spec:
  name: Policy Name
  query: SELECT * FROM table WHERE condition;
  critical: false
  description: |
    Multi-line policy description
  resolution: |
    Step-by-step resolution
  platform: darwin
---
apiVersion: v1
kind: policy
spec:
  # Next policy...

File Output:

Combined: output/cis-benchmark-macos15-fleetctl.yml (multi-document YAML)
Split: output/macos-15-fleetctl/Policy_Name.yml (individual Kubernetes documents)

Supported Platforms

Platform	Description	CIS Benchmark
`macos-13`	macOS 13 Ventura	CIS macOS 13.0 Benchmark
`macos-14`	macOS 14 Sonoma	CIS macOS 14.0 Benchmark
`macos-15`	macOS 15 Sequoia	CIS macOS 15.0 Benchmark
`win-10`	Windows 10	CIS Windows 10 Benchmark
`win-11`	Windows 11	CIS Windows 11 Benchmark

Run ./cis-to-fleet.sh list for the most current platform list.

CIS Compliance Levels

The script supports filtering by CIS compliance levels:

Level	Description	Use Case
Level 1	Essential security measures	All organizations, minimal impact
Level 2	Advanced security measures	High-security environments
All	Both Level 1 and Level 2	Complete coverage (default)

Examples:

# Essential security policies only
./cis-to-fleet.sh generate macos-15 gitops --level 1

# Advanced security policies only  
./cis-to-fleet.sh generate win-11 fleetctl --level 2

# All policies (default behavior)
./cis-to-fleet.sh generate macos-15 gitops --level all

How It Works

The script follows a systematic process to ensure reliable, accurate policy conversion:

🔍 Discovery - Queries GitHub API to find available CIS benchmark platforms
📥 Fetching - Downloads raw policy YAML files using GitHub's content API
🔧 Parsing - Processes Kubernetes-style YAML documents, handles multi-document files
🏷️ Filtering - Applies CIS level filtering based on policy tags (CIS_Level1, CIS_Level2)
🧹 Sanitization - Extracts essential fields, removes metadata, handles null values
📝 Transformation - Converts to target format with proper field ordering and structure
💾 Output - Generates clean YAML files with proper formatting and Fleet compatibility

Error Handling & Troubleshooting

Common Issues

Missing Dependencies:

✗ Missing required dependencies: yq
You can install them with: brew install yq

Solution: Install missing tools using your package manager.

Network Issues:

✗ Failed to fetch platform list from GitHub API

Solution: Check internet connection and GitHub availability.

Invalid CIS Level:

⚠ No policies found for macos-15 at CIS level 3

Solution: Use valid levels: 1, 2, or all.

File Conflicts:

⚠ File exists: ./output/cis-benchmark-macos15-gitops.yml (use --force to overwrite)

Solution: Use --force flag or remove existing files.

Debug Mode

Enable verbose logging for detailed troubleshooting:

./cis-to-fleet.sh generate macos-15 gitops --verbose

This shows:

API requests and responses
YAML parsing steps
File operations
Temporary file locations

Performance & Optimization

The bash implementation is optimized for speed and efficiency:

Metric	Performance
Startup Time	~50ms (vs 200ms TypeScript)
Memory Usage	~5MB (vs 50MB TypeScript)
Dependencies	3 system tools (vs Node.js ecosystem)
Distribution	Single file (vs npm modules)

Optimization Features:

⚡ Smart Caching - Temporary files prevent re-downloading
🔄 Streaming Processing - Minimal memory usage for large datasets
🧹 Auto Cleanup - Temporary files removed on exit
📊 Batch Processing - Multiple platforms processed efficiently

CI/CD Integration

GitHub Actions

name: Generate CIS Policies
on: [push]
jobs:
  generate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install dependencies  
        run: |
          sudo apt update
          sudo apt install jq
          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
          sudo chmod +x /usr/local/bin/yq
      - name: Generate policies
        run: |
          chmod +x cis-to-fleet.sh
          ./cis-to-fleet.sh generate --all gitops --output policies/
      - name: Upload artifacts
        uses: actions/upload-artifact@v3
        with:
          name: cis-policies
          path: policies/

Docker

FROM alpine:latest
RUN apk add --no-cache bash curl jq
RUN wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
RUN chmod +x /usr/local/bin/yq
COPY cis-to-fleet.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/cis-to-fleet.sh
ENTRYPOINT ["cis-to-fleet.sh"]

Makefile Integration

.PHONY: policies clean

policies:
	./cis-to-fleet.sh generate --all gitops --output policies/

clean:
	rm -rf policies/ output/

install-deps:
	brew install curl jq yq

Development & Contributing

Code Style

The script follows these conventions:

Functions: snake_case with descriptive names
Variables: snake_case with clear, descriptive names
Constants: UPPER_CASE for configuration values
Error Messages: Consistent color coding and format
Comments: Explain the "why", not just the "what"

Testing

# Test basic functionality
./cis-to-fleet.sh list
./cis-to-fleet.sh generate macos-15 gitops --output /tmp/test

# Test error handling
./cis-to-fleet.sh generate invalid-platform gitops
./cis-to-fleet.sh generate macos-15 invalid-format

# Test edge cases  
./cis-to-fleet.sh generate macos-15 gitops --level 3

Contributing Guidelines

Fork the repository
Create a feature branch: git checkout -b feature/your-feature
Test your changes thoroughly
Document any new functionality
Submit a Pull Request with clear description

License

MIT License - see LICENSE file for details.

Support

📖 Documentation: This README and inline script comments
🐛 Issues: GitHub Issues
💬 Discussions: GitHub Discussions
📧 Contact: Open an issue for questions or support

Made with ❤️ for the Fleet community

Name		Name	Last commit message	Last commit date
.github/workflows		.github/workflows
policies		policies
.gitignore		.gitignore
.pre-commit-config.yaml		.pre-commit-config.yaml
README.md		README.md
cis-to-fleet.sh		cis-to-fleet.sh

Navigation Menu

Repository files navigation

CIS to Fleet

Quick Start

Dependencies

Platform-Specific Installation

Usage

Command Structure

Available Commands

`list` - Show Available Platforms

`generate` - Create Fleet Policy Files

Usage Examples

Output Formats

GitOps Format (`gitops`)

Fleetctl Format (`fleetctl`)

Supported Platforms

CIS Compliance Levels

How It Works

Error Handling & Troubleshooting

Common Issues

Debug Mode

Performance & Optimization

CI/CD Integration

GitHub Actions

Docker

Makefile Integration

Development & Contributing

Code Style

Testing

Contributing Guidelines

License

Support

About

Releases

Packages

Used by

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

CIS to Fleet

Quick Start

Dependencies

Platform-Specific Installation

Usage

Command Structure

Available Commands

list - Show Available Platforms

generate - Create Fleet Policy Files

Usage Examples

Output Formats

GitOps Format (gitops)

Fleetctl Format (fleetctl)

Supported Platforms

CIS Compliance Levels

How It Works

Error Handling & Troubleshooting

Common Issues

Debug Mode

Performance & Optimization

CI/CD Integration

GitHub Actions

Docker

Makefile Integration

Development & Contributing

Code Style

Testing

Contributing Guidelines

License

Support

About

Resources

Stars

Watchers

Forks

Releases

Packages

Used by

Contributors

Languages

`list` - Show Available Platforms

`generate` - Create Fleet Policy Files

GitOps Format (`gitops`)

Fleetctl Format (`fleetctl`)