Agent-Based CIS Policies Not Being Maintained

Seeing an alarming trend of agent-based CIS policies not being updated in InsightVM and was curious if this feature is planned to be maintained in an ongoing basis.

This is a relatively newer feature and has potential to be great, but Rapid7 has not been maintaining the updates to CIS policies. In fact, I am not sure if any are up to date at least in the Microsoft world.

For example,

  • Google Chrome’s CIS policies are only version 2.1 in InsightVM - 3.0 was released on Jan 29, 2024.

  • Microsoft Edge’s latest CIS policies are version 2.0, 3.0 was released on July 19, 2024

  • Windows 11 CIS Enterprise is 2.0 - 3.0 was released on Feb 22, 2024.

  • Windows 11 CIS Stand-alone is still on 1.0 (!), 3.0 was released on May 24, 2024 and 2.0 was released on Oct 20, 2023

  • Windows 11 InTune is on 1.0(!), 3.0.1 was released on March 1 2024, 3.0 on Feb 23, 2024, and 2.0 was released on Oct 20, 2023,

  • Windows 10 same deal…

2 Likes

I have encountered this same problem. We had to stop using InsightVM to do compliance assessments and switch to CIS cat pro.

Yes I think I was able to find Debian 10 while we are at Deb12 now :slight_smile: