CIS Auditor Guide

Prerequisites

Before installing the agent, make sure the target machine meets these requirements.

Quick Install (Recommended)

The quickest way to get started is the one-line PowerShell installer. It downloads the agent binary, enrolls the endpoint, and sets up a background service — all in under a minute.

# Replace the token value with yours
$token = "YOUR-TOKEN-HERE"
& ([scriptblock]::Create((irm 'https://app.corvus-security.net/downloads/install.ps1'))) -Token $token

# Download installer script
Invoke-WebRequest -Uri 'https://app.corvus-security.net/downloads/install.ps1' -OutFile install.ps1

# Run it (still requires elevation)
powershell -ExecutionPolicy Bypass -File .\install.ps1 -Token "YOUR-TOKEN-HERE"

# Check scheduled task state (should say "Running")
(Get-ScheduledTask -TaskName CISAuditorAgent).State

# View recent agent log lines
Get-Content "C:\ProgramData\CIS-Auditor\agent.log" -Tail 20

Manual / Offline Install

Use the manual method when you need to deploy via MDM (Intune, SCCM, Ansible), when machines have no direct internet access during install, or when you prefer full control over file placement.

Step 1 – Download the installer package

Download coreagent-installer.zip from the dashboard Agents page or the Releases page. Extract it — you will find:

• coreagent.exe — the agent binary
• install.ps1 — interactive PowerShell installer
• install.bat — wrapper that calls install.ps1 with elevation
• uninstall.ps1 — clean uninstaller

Step 2 – Place the binary

Copy coreagent.exe to your chosen install directory. The default path expected by the installer is:

C:\ProgramData\CIS-Auditor\coreagent.exe

Step 3 – Enroll the endpoint

Run the enroll command from an elevated command prompt or PowerShell. Replace the placeholders with your actual values.

REM Command Prompt (elevated)
C:\ProgramData\CIS-Auditor\coreagent.exe enroll ^
  --url https://app.corvus-security.net ^
  --token YOUR-ENROLLMENT-TOKEN

On success the agent prints [OK] enrolled and writes two files:

• C:\ProgramData\CIS-Auditor\agent.json — agent ID and backend URL
• C:\ProgramData\CIS-Auditor\credentials.enc — DPAPI-encrypted agent secret

Step 4 – Register the background service

Register the agent as a Windows Scheduled Task so it starts automatically and restarts on failure:

# PowerShell (elevated)
$exe      = "C:\ProgramData\CIS-Auditor\coreagent.exe"
$action   = New-ScheduledTaskAction -Execute $exe -Argument 'run'
$trigger  = New-ScheduledTaskTrigger -AtStartup
$settings = New-ScheduledTaskSettingsSet `
    -ExecutionTimeLimit ([TimeSpan]::Zero) `
    -RestartCount 5 -RestartInterval (New-TimeSpan -Minutes 1) `
    -MultipleInstances IgnoreNew -StartWhenAvailable
$principal = New-ScheduledTaskPrincipal -UserId SYSTEM -LogonType ServiceAccount -RunLevel Highest

Register-ScheduledTask -TaskName CISAuditorAgent `
    -Action $action -Trigger $trigger `
    -Settings $settings -Principal $principal -Force

Start-ScheduledTask -TaskName CISAuditorAgent

Unattended / MDM Deployment

For Intune, SCCM, or Ansible deployments, use the install.ps1 script with inline parameters — no interactive prompts:

powershell -ExecutionPolicy Bypass -NoProfile -File .\install.ps1 `
  -Token "YOUR-ENROLLMENT-TOKEN" `
  -Url   "https://app.corvus-security.net"

The script exits with code 0 on success and 1 on failure, so it integrates cleanly with deployment tool error handling.

Running a Scan

Once the agent is enrolled and online, you can trigger a compliance scan from the dashboard or via the API.

From the Dashboard

1. 1 Open Scans in the sidebar.
2. 2 Click New Scan. Select the target agent, rule pack (e.g. Windows 11 CIS L1), and CIS level.
3. 3 Click Run Scan. The job enters the queue and the agent picks it up within 30 seconds.
4. 4 The scan page refreshes automatically. Click any result row to see the finding details.

From the Command Line (on the endpoint)

You can also trigger a scan locally for quick testing without the dashboard:

REM Scan with auto-detected OS pack, print results to stdout
coreagent.exe scan

REM Scan a specific pack and CIS level
coreagent.exe scan --pack windows11-cis-l1 --level 1

REM Save results as JSON
coreagent.exe scan --pack windows11-cis-l1 --out results.json

Understanding Results

Each finding has one of four statuses:

The compliance score at the top of each scan is calculated as: passed checks ÷ (total − N/A), expressed as a percentage. Error findings count as failed.

Dashboard Tour

Dashboard

The main dashboard shows your fleet at a glance: total agents, online/offline count, recent scan scores, and open support tickets. The Download section at the bottom lets you grab the agent installer directly.

Agents

Lists all enrolled endpoints with their current status, last heartbeat time, and latest scan score. Click an agent row to open its detail page — you can see per-agent scan history and trigger a new scan directly from there.

The Generate Token button creates a new enrollment token for onboarding another endpoint. Tokens expire after 24 hours.

Scans

Shows all scan jobs across all agents. Click any row to open the scan detail page, which includes:

• Overall compliance score with a visual ring gauge
• Pass / Fail / Error / N/A summary cards
• Findings grouped by CIS category (e.g. Account Policies, Windows Firewall)
• Per-finding observed vs. expected value comparison
• Remediation guidance for each failed control
• Export to JSON, CSV, or printable HTML report

Policies

Policies define what gets scanned, when, and at which CIS level. Create a policy to schedule recurring compliance checks without manual intervention.

• Select a rule pack and CIS level (L1 = basic hardening, L2 = strict hardening)
• Optionally restrict to specific CIS categories
• Set a cron schedule (e.g. daily at 02:00, every Monday morning)

Settings

Manage your account, users, and API tokens. Under the Security tab you can:

• Change your password
• Enable two-factor authentication (TOTP)
• Create API tokens (csk_…) for programmatic access

Scan Policies

Policies let you automate scans on a schedule so compliance is continuously monitored rather than spot-checked. A policy is assigned per-tenant (applies to all agents in your account).

Creating a policy

1. Go to Policies → New Policy
2. Give it a name (e.g. "Windows 11 Weekly L1")
3. Select the rule pack and CIS level
4. Optionally filter by CIS categories (leave blank to scan everything)
5. Set the schedule: choose a preset (daily, weekly, monthly) or enter a custom cron expression
6. Click Save

Remediation

The scan detail page includes two action icons on every failing finding:

Configuration

The agent stores its configuration in C:\ProgramData\CIS-Auditor\.

CLI commands

coreagent.exe <command>

  enroll        Enroll this endpoint with the backend
  run           Start the background polling daemon
  scan          Run a compliance scan (prints results)
  heartbeat     Send a single heartbeat to the backend
  update        Check for and apply agent updates
  diagnostics   Self-test: config, credentials, connectivity, packs
  version       Print agent version

Running diagnostics

The built-in diagnostics command checks everything in one go:

coreagent.exe diagnostics

It verifies: config file, DPAPI credentials, OS detection, available rule packs, backend connectivity, and a live heartbeat. Look for any lines beginning with FAIL.

Uninstalling

To remove the agent from an endpoint, run the uninstaller from an elevated PowerShell:

# From the installer directory
powershell -ExecutionPolicy Bypass -File .\uninstall.ps1

# Remove config files too (clears credentials.enc and agent.json)
powershell -ExecutionPolicy Bypass -File .\uninstall.ps1 -RemoveConfig

If you no longer have the installer, remove the scheduled task manually:

# Stop and remove scheduled task
Stop-ScheduledTask   -TaskName CISAuditorAgent
Unregister-ScheduledTask -TaskName CISAuditorAgent -Confirm:$false

# Remove install directory (optional)
Remove-Item -Recurse -Force "C:\ProgramData\CIS-Auditor"

Troubleshooting

powershell -ExecutionPolicy Bypass -File .\install.ps1 -Token "YOUR-TOKEN"