Tool Management Walkthrough¶

CISentinel manages the discovery, installation, and verification of security scanning tools across platforms.

Checking Tool Status¶

Rich Table Output (default)¶

cis-hardening-tool tools status

┏━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Tool            ┃ Status         ┃ Notes                       ┃
┡━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ openscap        │ Installed      │                             │
│ lynis           │ Installed      │                             │
│ usg             │ Missing        │ Requires Ubuntu Pro         │
│ ciscat          │ Missing        │ Automated download from CIS │
│ hardeningkitty  │ Incompatible   │ Available on Windows        │
│ sct             │ Incompatible   │ Available on Windows        │
└─────────────────┴────────────────┴─────────────────────────────┘

JSON Output (for scripting)¶

cis-hardening-tool --json tools status

[
  {"name": "openscap", "status": "Installed", "compatible": true, "notes": ""},
  {"name": "lynis", "status": "Installed", "compatible": true, "notes": ""},
  {"name": "usg", "status": "Missing", "compatible": true, "notes": ""},
  {"name": "ciscat", "status": "Missing", "compatible": true, "notes": ""},
  {"name": "hardeningkitty", "status": "Incompatible", "compatible": false, "notes": "Available on Windows"},
  {"name": "sct", "status": "Incompatible", "compatible": false, "notes": "Available on Windows"}
]

Installing Tools¶

Install all missing compatible tools¶

sudo cis-hardening-tool tools install --yes

Install specific tools¶

sudo cis-hardening-tool tools install lynis openscap --yes

Without --yes (interactive confirmation)¶

sudo cis-hardening-tool tools install lynis

How Tool Installation Works¶

CISentinel's ToolManager automatically:

1. Detects the OS family (Debian, Red Hat, SUSE, Windows)
2. Selects the right package manager (apt, dnf, yum, zypper, winget)
3. Resolves distro-specific package names (e.g., openscap-scanner on Ubuntu vs openscap-utils on Debian 12)
4. Downloads from URLs for tools not in repos (CIS-CAT Lite, HardeningKitty)
5. Verifies functional installation (not just file existence — actually runs verification commands)

Package Manager Support¶

Distro-Specific Package Mappings¶

The tool maintains version-specific package name mappings. For example, OpenSCAP:

Supported Tools¶

Linux Tools¶

Windows Tools¶