cataam - Open-source GRC tooling — CIS hardening scripts, C

项目说明

<p align="center">
<a href="
<img src="./assets/logo.svg" alt="Cataam — Security · Compliance" height="70" />
</a>
</p>

<p align="center">
<a href=" src=" alt="Maintained by Cataam"></a>
<a href="LICENSE"><img src=" alt="MIT License"></a>
<a href=" src=" alt="GitHub Stars"></a>
<a href=" src=" alt="Issues"></a>
</p>

<p align="center">
<strong>Open-source security tooling and compliance knowledge — maintained by the <a href=" team.</strong>
</p>

---

Cataam is a commercial GRC, iASM & BAS platform for CISOs, CPAs, and enterprises. This repository is the open-source initiative that comes with it — practical scripts, C tools, hardening guides, and compliance templates shared freely with the security community.

E here is MIT-licensed and production-ready. Use it standalone, integrate it into your own tooling, or contribute back.

---

What's in This Repository

| Folder | Purpose | Who It Helps |
|--------|---------|--------------|
| /prompt-guard | Local-first prompt hygiene — redact secrets/keys/PII before they reach public LLMs; outputs ISO 42001 / NIST AI RMF / EU AI Act e | Security, AppSec, Compliance, De |
| /tools | Hardening scripts, C, cloud posture checks, TLS audits | DevOps, SecOps, Compliance Engineers |
| /c | C and mitigation scripts, updated within 48h of major disclosures | Incident Responders, SREs |
| /knowledge | CIS Benchmark guides, ISO 27001 control mappings, compliance cheatsheets | Security Analysts, Auditors |
| /templates | ISO 27001 risk assessments, SOC 2 e checklists, HIPAA security rule templates | Compliance Officers, CTOs |
| /wiki | Security glossary and GRC explainers | E |

---

Quick Start

Scan for Log4Shell (C):

Harden a Linux ser CIS Benchmarks:

Audit TLS configuration (PCI DSS 4.0 Req 4.2):

Check AWS cloud posture (CIS AWS Foundations v1.5):

---

Tools

en.sh

Applies CIS Benchmark Level 1 and Level 2 hardening checks to Linux servers. Maps every finding to a CIS control ID and outputs a human-readable compliance report.

Frameworks: CIS Benchmark Linux v3.0, ISO 27001 A.8

c.py

Queries the NVD API for C a gi/, scores them with CVSS v3, and maps each finding to ISO 27001 Annex A controls and SOC 2 criteria.

Frameworks: ISO 27001:2022 A.12.6, SOC 2 CC7

log4shell-detector.sh

Scans a host for Log4j — including nested JARs inside WAR/EAR archives, running J, and class-le.

CVE: C (CVSS 10.0 CRITICAL)

cloud-posture-check.py

Audits AWS en against the CIS AWS Foundations Benchmark v1.5. Checks IAM, S3, Security Groups, CloudTrail, VPC Flow Logs, and KMS configuration.

Frameworks: CIS AWS Foundations v1.5, SOC 2 CC6, ISO 27001 A.9

ssl-tls-audit.py

Audits TLS , cipher suites, and certificate . Flags deprecated protocols (SSLv3, TLS 1.0/1.1) and weak cipher suites.

Frameworks: PCI DSS 4.0 Req 4.2, SOC 2 CC6.7, ISO 27001 A.8.24

---

Knowledge Base

CIS Benchmark Linux Hardening Guide — Practical hardening reference for Linux servers

ISO 27001:2022 Control Mapping — Annex A controls with implementation guidance

Multi-Framework Compliance Mapping — Cross-reference between CIS, ISO 27001, SOC 2, HIPAA, and PCI DSS

---

Templates

Ready-to-use compliance document templates:

ISO 27001 Risk Assessment — likelihood × impact scoring matrix with Annex A mapping. Automate it with ISO 27001 compliance automation.

SOC 2 E Checklist — control-by-control e list for a Type II audit. Automate it with SOC 2 compliance automation.

HIPAA Security Rule Checklist — administrati, and technical safeguards. Automate it with HIPAA compliance automation.

---

Contributing

Pull requests are welcome. For new tools, please:
1. Map findings to at least one compliance framework
2. Add usage documentation to the relevant folder README
3. Keep tools dependency-light and well-commented

See CONTRIBUTING.md for full guidelines.

---

About Cataam

Cataam is a GRC, iASM & BAS platform built for CISOs, CPAs, and enterprises. It provides continuous control monitoring, automated e collection, and attack surface management — so compliance becomes an operational output rather than a periodic audit exercise.

This open-source repository is Cataam's contribution to the security community.

---

License

MIT — see LICENSE. Free to use, fork, and build upon.

项目信息

开发语言：Python

Star 数：12

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Open-source GRC tooling — CIS hardening scripts, CVE scanners, ISO 27001 templates, and compliance knowledge. Maintained by Cataam.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。