Local tag - update

code/linux/audit/autofs-service.yaml

@@ -16,7 +16,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu
+  tags: cis,local,cisecurity,audit,linux,ubuntu
 
 self-contained: true
 

code/linux/audit/avahi-daemon.yaml

@@ -13,7 +13,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu
+  tags: cis,local,cisecurity,audit,linux,ubuntu
 
 self-contained: true
 

code/linux/audit/dhcp-server.yaml

@@ -13,7 +13,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu
+  tags: cis,local,cisecurity,audit,linux,ubuntu
 
 self-contained: true
 

code/linux/audit/dns-server.yaml

@@ -13,7 +13,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu
+  tags: cis,local,cisecurity,audit,linux,ubuntu
 
 self-contained: true
 

code/linux/audit/dns-zone-transfer-any.yaml

@@ -8,7 +8,7 @@ info:
     DNS Zone Transfer configured with "allow-transfer { any; };" allowed unrestricted zone transfers.This exposed sensitive details like hostnames, network structure, and system data that attackers could use for reconnaissance and further attacks.
   reference:
     - https://isms.kisa.or.kr
-  tags: linux,kisa,audit,compliance
+  tags: linux,local,kisa,audit,compliance
 
 self-contained: true
 

code/linux/audit/dnsmasq-service.yaml

@@ -13,7 +13,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu
+  tags: cis,local,cisecurity,audit,linux,ubuntu
 
 self-contained: true
 

code/linux/audit/finger-service-enabled.yaml

@@ -8,7 +8,7 @@ info:
     The Finger service was enabled on the system and exposed user account details to unauthorized users, which could have been used in password-based attacks or user enumeration.It was checked in both xinetd and systemd environments.
   reference:
     - https://isms.kisa.or.kr
-  tags: linux,code,audit,compliance,kisas
+  tags: linux,local,code,audit,compliance,kisas
 
 self-contained: true
 

code/linux/audit/ftp-client.yaml

@@ -13,7 +13,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu,ftp
+  tags: cis,local,cisecurity,audit,linux,ubuntu,ftp
 
 self-contained: true
 

code/linux/audit/ftp-server.yaml

@@ -13,7 +13,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu
+  tags: cis,local,cisecurity,audit,linux,ubuntu
 
 self-contained: true
 

code/linux/audit/home-env-permission.yaml

@@ -8,7 +8,7 @@ info:
     Shell startup and environment files (e.g., .bashrc, .bash_profile, .bash_logout) were not owned by the user or root and had insecure write permissions.Malicious users could manipulate environment variables or inject commands.
   reference:
     - https://isms.kisa.or.kr
-  tags: linux,audit,compliance,kisa
+  tags: linux,local,audit,compliance,kisa
 
 self-contained: true
 

code/linux/audit/inactive-password-lock-default.yaml

@@ -12,7 +12,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu,password
+  tags: cis,local,cisecurity,audit,linux,ubuntu,password
 
 self-contained: true
 

code/linux/audit/ldap-client.yaml

@@ -13,7 +13,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu,ldap
+  tags: cis,local,cisecurity,audit,linux,ubuntu,ldap
 
 self-contained: true
 

code/linux/audit/ldap-server.yaml

@@ -13,7 +13,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu
+  tags: cis,local,cisecurity,audit,linux,ubuntu
 
 self-contained: true
 

code/linux/audit/linux-anonymous-ftp-enabled.yaml

@@ -10,7 +10,7 @@ info:
     - https://isms.kisa.or.kr
   metadata:
     verified: true
-  tags: linux,kisa,audit,ftp,anonymous,local
+  tags: linux,local,kisa,audit,ftp,anonymous,local
 
 self-contained: true
 

code/linux/audit/linux-rexec-service.yaml

@@ -8,7 +8,7 @@ info:
     Assessed the operational status of the rexec service on the system.Running rexec could have allowed unauthorized users to gain access or extract sensitive information, representing a significant security risk.
   reference:
     - https://isms.kisa.or.kr
-  tags: linux,audit,kisa,compliance
+  tags: linux,local,audit,kisa,compliance
 
 self-contained: true
 

code/linux/audit/linux-rhosts-hostsequiv-misconfig.yaml

@@ -9,7 +9,7 @@ info:
   reference:
     - https://isms.kisa.or.kr
     - https://linux.die.net/man/5/hosts.equiv
-  tags: linux,audit,kisa,compliance
+  tags: linux,local,audit,kisa,compliance
 
 self-contained: true
 

code/linux/audit/linux-rlogin-service.yaml

@@ -8,7 +8,7 @@ info:
     Assessed the operational status of the rlogin service on the system.Running rlogin could have allowed unauthorized users to gain access or extract sensitive information, representing a significant security risk.
   reference:
     - https://isms.kisa.or.kr
-  tags: linux,audit,kisa,compliance
+  tags: linux,local,audit,kisa,compliance
 
 self-contained: true
 

code/linux/audit/linux-rsh-service.yaml

@@ -8,7 +8,7 @@ info:
    Assessed the operational status of the rsh service on the system.Running rsh could have allowed unauthorized users to gain access or extract sensitive information, representing a significant security risk.
   reference:
     - https://isms.kisa.or.kr
-  tags: linux,audit,kisa,compliance
+  tags: linux,local,audit,kisa,compliance
 
 self-contained: true
 

code/linux/audit/linux-world-writable-file.yaml

@@ -8,7 +8,7 @@ info:
     System files were configured with world-writable (chmod o+w) permissions.Malicious users could modify them, leading to privilege escalation, backdoors, or service disruption.
   reference:
     - https://isms.kisa.or.kr
-  tags: linux,audit,compliance,kisa
+  tags: linux,local,audit,compliance,kisa
 
 self-contained: true
 

code/linux/audit/message-access-server.yaml

@@ -13,7 +13,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu
+  tags: cis,local,cisecurity,audit,linux,ubuntu
 
 self-contained: true
 

code/linux/audit/nfs-daemon-service.yaml

@@ -8,7 +8,7 @@ info:
      Assessed the status of the NFS service daemon. A running NFS service may expose the system to unauthorized access, modification, or deletion of files; it is recommended to disable the daemon when not explicitly required.
   reference:
     - https://isms.kisa.or.kr
-  tags: linux,audit,kisa,compliance
+  tags: linux,local,audit,kisa,compliance
 
 self-contained: true
 

code/linux/audit/nfs-insecure-exports.yaml

@@ -8,7 +8,7 @@ info:
     Verified whether access control was properly configured on NFS.Highlighted possibilities such as allowing all hosts, no_root_squash, or unrestricted all_squash that could let unauthorized users access shared directories.
   reference:
     - https://isms.kisa.or.kr
-  tags: linux,audit,kisa,compliance
+  tags: linux,local,audit,kisa,compliance
 
 self-contained: true
 

code/linux/audit/nis-client.yaml

@@ -13,7 +13,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu,nis
+  tags: cis,local,cisecurity,audit,linux,ubuntu,nis
 
 self-contained: true
 

code/linux/audit/password-expiration.yaml

@@ -12,7 +12,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu,password
+  tags: cis,local,cisecurity,audit,linux,ubuntu,password
 
 self-contained: true
 

code/linux/audit/password-min-days.yaml

@@ -12,7 +12,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu,password
+  tags: cis,local,cisecurity,audit,linux,ubuntu,password
 
 self-contained: true
 

code/linux/audit/password-warn-age.yaml

@@ -12,7 +12,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu,password
+  tags: cis,local,cisecurity,audit,linux,ubuntu,password
 
 self-contained: true
 

code/linux/audit/rsh-client.yaml

@@ -1,4 +1,4 @@
-id: ssh-rsh-client
+id: rsh-client
 
 info:
   name: Ensure rsh Client is Not Installed
@@ -12,7 +12,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu,rsh
+  tags: cis,local,cisecurity,audit,linux,ubuntu,rsh
 
 self-contained: true
 

code/linux/audit/smtp-open-relay.yaml

@@ -8,7 +8,7 @@ info:
     Sendmail and Postfix were checked for proper restrictions against unauthorized relay attempts. Improper configurations allowed attackers to abuse the server for spam or denial-of-service (DoS) attacks.
   reference:
     - https://isms.kisa.or.kr
-  tags: linux,kisa,audit,compliance
+  tags: linux,local,kisa,audit,compliance
 
 self-contained: true
 

code/linux/audit/ssh-gssapiauthentication-disabled.yaml

@@ -12,7 +12,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,ssh,linux,audit,ubuntu,benchmark
+  tags: cis,local,ssh,linux,audit,ubuntu,benchmark
 
 self-contained: true
 

code/linux/audit/ssh-hostbasedauth-disabled.yaml

@@ -13,7 +13,7 @@ info:
     - https://docs.datadoghq.com/security/default_rules/def-000-fqw/
   metadata:
     verified: true
-  tags: cis,ssh,linux,audit,ubuntu,benchmark
+  tags: cis,local,ssh,linux,audit,ubuntu,benchmark
 
 self-contained: true
 

code/linux/audit/strong-password-hashing.yaml

@@ -12,7 +12,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu,password
+  tags: cis,local,cisecurity,audit,linux,ubuntu,password
 
 self-contained: true
 

code/linux/audit/syslog-rsyslog-permission.yaml

@@ -8,7 +8,7 @@ info:
     The /etc/syslog.conf or /etc/rsyslog.conf file was not owned by root or had insecure permissions,allowing attackers to manipulate logging settings to evade detection.
   reference:
     - https://isms.kisa.or.kr
-  tags: linux,kisa,audit,compliance
+  tags: linux,local,kisa,audit,compliance
 
 self-contained: true
 

code/linux/audit/talk-client.yaml

@@ -12,7 +12,7 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu,talk
+  tags: cis,local,cisecurity,audit,linux,ubuntu,talk
 
 self-contained: true
 

code/linux/audit/tcpwrapper-access.yaml

@@ -8,7 +8,7 @@ info:
     Checked if IP and port restrictions were properly applied using TCP Wrapper (/etc/hosts.allow and /etc/hosts.deny). Reported systems as vulnerable if unrestricted remote access (e.g. Telnet, RSH, SSH) was possible.
   reference:
     - https://isms.kisa.or.kr
-  tags: linux,audit,kisa,compliance
+  tags: linux,local,audit,kisa,compliance
 
 self-contained: true
 

code/linux/audit/telnet-client.yaml

@@ -12,12 +12,13 @@ info:
     - https://www.cisecurity.org/benchmark/ubuntu_linux
   metadata:
     verified: true
-  tags: cis,cisecurity,audit,linux,ubuntu,telnet
+  tags: cis,local,cisecurity,audit,linux,ubuntu,telnet
 
 self-contained: true
 
 code:
   - engine:
+      - sh
       - bash
 
     args:

code/linux/audit/tftp-service-enabled.yaml

@@ -8,7 +8,7 @@ info:
     The tftp service was rarely needed and contained known vulnerabilities that could have been targeted by attackers.It was checked to confirm that the tftp service was properly disabled in the xinetd configuration.
   reference:
     - https://isms.kisa.or.kr
-  tags: linux,code,audit,compliance,kisas
+  tags: linux,local,code,audit,compliance,kisas
 
 self-contained: true
 

code/linux/audit/weak-password-complexity.yaml

@@ -10,7 +10,7 @@ info:
     - https://isms.kisa.or.kr/main/csap/notice/
   metadata:
     verified: true
-  tags: linux,audit,kisa,compliance,local
+  tags: linux,local,audit,kisa,compliance,local
 
 self-contained: true