Evidence automation and continuous control monitoring
Instead of gathering control evidence by hand with screenshots, you pull it from systems with scripts, seal it with timestamps and hashes, turn control tests into code and build a continuous compliance dashboard.
Level 401 · 14 lessons · 12 practice labs
Lessons
Why automate
- The trouble with manual evidence
- Continuous control monitoring concepts
- Turning a control into a testable rule
- Quick task: pick the controls you can automate
Evidence collectors
- Collecting user and group evidence
- Collecting configuration evidence
- Pulling change history from Git
- Sealing evidence: time, hash, signature
- Quick task: a collector script for three controls
Continuous monitoring
- Scheduled control tests
- Drift alerts and ticketing
- The compliance dashboard
- Getting auditors to accept automated evidence
- Capstone: a continuous monitoring set-up for ten controls
Practice labs
- Pick the controls you can automate: Classify twenty controls as fully automatable, partly automatable or manual evidence only.
- Turn a control into a testable rule: Turn six control statements into rules with a clear data source, condition and pass criterion.
- Test the rule with a command: Test three rules on the lab server with one command each and write pass or fail in machine-readable form.
- Collect user and group evidence: Dump the users, groups and administrator rights on the lab server to a time-stamped file.
- A collector script for three controls: Prepare a script that collects password policy, firewall rules and patch status and writes them to one folder.
- Pull the change history from Git: From a repository, extract the merges in the period, their approver and those without review and produce an evidence table.
- Hash the evidence: Calculate the hashes of files in an evidence folder and write them to a manifest file.
- Seal the evidence and verify it: Seal the evidence pack with time, hash and signature, then show that an altered copy fails verification.
- Set up a scheduled control test: Schedule the collector to run daily, write results to dated folders and log an entry on failure.
- Read a drift alert: From five drift alerts, work out which control broke on which system and when.
- Produce the compliance dashboard data: From daily test results, produce a summary table with pass rate per control and the date of the last failure.
- An assurance note for the auditor: Write an assurance note explaining the source, completeness, script change control and integrity check of automated evidence.
About this course
Instead of gathering control evidence by hand with screenshots, you pull it from systems with scripts, seal it with timestamps and hashes, turn control tests into code and build a continuous compliance dashboard.
What you will learn
- Why automate
- Evidence collectors
- Continuous monitoring
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.