CIS Intune for Microsoft Defender Antivirus Benchmark

CIS Intune for Microsoft Defender Antivirus Benchmark

A Maester Pack that checks your Intune policies against the Level 1 recommendations of the CIS Intune for Microsoft Defender Antivirus Benchmark v1.0.0. One test per setting; tests are numbered in the order they were added (MP.JL.CISDEFINT.L1.001), and each test's description names its recommendation.

The tests read policy configuration (a policy exists, is assigned and has the value), not whether devices applied it.

Install and run

Install-MtPack Pacers31Colts18/maester-packs-joeloveless/cis-defender-intune-l1
Connect-Maester
Invoke-Maester -Pack JL.CISDEFINT.L1

Maester's default Graph scopes include what the pack reads (DeviceManagementConfiguration.Read.All, and GroupMember.Read.All to show group names). An account with the Global Reader role is enough.

How a setting test decides

A test passes when at least one assigned policy sets the setting as the recommendation requires and no other assigned policy sets it to something else. What a test checks is in its parameters, with the recommendation's values as defaults (Get-MtTest -Path ./cis-defender-intune-l1 | Select-Object -ExpandProperty Parameters lists them):

Changing Source, Platform, SettingDefinitionId or Expected in the config changes what the test checks; the result row records that the value came from Config. Set a filter for every test at once with GlobalSettings, or tune one test with TestSettings, in maester-config.json:

{
  "GlobalSettings": { "JLIntune.PolicyNameFilter": "W11-CIS-*" }
}

Moving to a new benchmark version

The benchmark's name and version are set in one place: tests/frameworks/cis-intune-defint-l1.json (Name, Version). Maester writes that version on every result row.

1. Change Version in the framework file.
2. Run Test-JLMaesterPack. It fails and lists each text that still names the old version (the manifest Description, the guide Summary, this README and the repository README). Update them.
3. Update the tests whose recommendations changed, and the Requirements in the framework file: add new recommendation IDs, remove withdrawn ones.
4. Bump Version in maester-pack.json and add a ## cis-defender-intune-l1 <version> entry to CHANGELOG.md.

The pack's Code and test IDs stay the same, so Update-MtPack moves everyone to the new release.

Tests