A real-time compliance dashboard that transforms CIS Benchmarks into actionable security intelligence. Built for security teams who need to move beyond checkbox compliance to understanding their actual defensive posture.
| Audience | What You'll Get |
|---|---|
| IT Auditors | Clear compliance percentages, failed policy lists, and remediation steps for audit evidence |
| Security Teams | MITRE ATT&CK mapping, D3FEND defensive techniques, and risk prioritization |
| Executives | High-level compliance scores, trend analysis, and priority action items |
| SOC Analysts | Real-time visibility into endpoint security gaps and their business impact |
- Docker and Docker Compose
- A running Fleet instance with CIS policies deployed
- Fleet API token with read access
This dashboard integrates with CIS Controls v8.1 benchmarks from the fleet_policies repo:
- macOS 26.x: CIS-8.1/macOS26
- Windows 11: CIS-8.1/win11/intune
- Ubuntu 24.04: CIS-8.1/ubuntu24
-
Configure Fleet credentials
Copy the example environment file and edit it with your Fleet credentials:
cp .env.example .env
Edit
.envand set your values:FLEET_URL=https://your-fleet-instance.com FLEET_API_TOKEN=your-fleet-api-tokenDocker Compose automatically loads variables from
.envwhen you rundocker-compose up. -
Start the dashboard
docker-compose up -d --build
-
Access the dashboard
| View | Purpose |
|---|---|
| Summary | Compliance percentage, device counts, risk level indicator |
| Security Architecture | Interactive D3FEND heatmap showing defensive coverage |
| Compliance Audit | Detailed list of failed policies with remediation steps |
| Executive Strategy | Fleet leaderboard, trends, and priority actions |
- CIS Controls v8.1: Base benchmark framework
- MITRE ATT&CK: Maps failed controls to adversary techniques
- D3FEND: Recommends defensive countermeasures for gaps
The dashboard automatically handles edge cases:
| Condition | Risk Level |
|---|---|
| No hosts enrolled | UNAVAAILABLE |
| No policy results (mapping not possible) | HIGH |
| Compliance < 50% | CRITICAL |
| Compliance 50-70% | HIGH |
| Compliance 70-85% | MEDIUM |
| Compliance > 85% | LOW |
┌─────────────────────────────────────────────────────────────┐
│ Nginx (Port 8081) │
│ Serves UI + Reverse Proxy │
└─────────────────────────┬───────────────────────────────────┘
│
┌───────────────┴───────────────┐
│ │
┌─────▼─────┐ ┌────▼────┐
│ Backend │ │ Sync │
│ (Flask) │◄─────────────────│ Daemon │
└─────┬─────┘ └─────────┘
│
┌─────┴─────┐
│ │
┌───▼───┐ ┌──▼────┐
│ DB │ │ Redis │
│(Postgres)│ (Cache)│
└───────┘ └───────┘
| Component | Technology | Purpose |
|---|---|---|
| Frontend | Vanilla JS + Chart.js | Interactive dashboard |
| Backend | Flask + Gunicorn | REST API |
| Sync | Python daemon | Fleet data synchronization |
| Database | PostgreSQL 16 | Persistent storage with time partitioning |
| Cache | Redis 7 | API response caching |
| Web Server | Nginx | UI serving + reverse proxy |
| Variable | Description | Default |
|---|---|---|
FLEET_URL |
Your Fleet instance URL | Required |
FLEET_API_TOKEN |
Fleet API token | Required |
DATABASE_URL |
PostgreSQL connection | postgresql://postgres:postgres@db:5432/fleet_cis |
REDIS_URL |
Redis connection | redis://redis:6379/0 |
ALLOWED_ORIGINS |
CORS allowed domains | http://localhost:8081 |
SYNC_INTERVAL_MINUTES |
Sync frequency | 15 |
Access the Settings page to configure:
- Risk Exposure Multiplier: Weight for risk calculations
- Impact Thresholds: Define what counts as high/medium impact
- Effort Keywords: Classify remediation effort by query output
- Framework Multipliers: Customize scoring by compliance framework
The sync daemon runs every 15 minutes automatically. View logs:
docker-compose logs -f syncForce an immediate sync:
docker-compose exec sync python backend/sync_fleet_data.py- Non-root container: Backend runs as unprivileged
appuser - Network isolation: Services communicate on internal network only
- CORS protection: API restricted to configured origins
- No secrets in image: All credentials passed via environment
- Check Fleet credentials in
.env - Verify sync daemon is running:
docker-compose ps - Check sync logs:
docker-compose logs sync
- Wait for PostgreSQL to be healthy:
docker-compose ps - Check logs:
docker-compose logs db
- Verify nginx is running:
docker-compose ps - Check logs:
docker-compose logs nginx
MIT License. See LICENSE for details.