[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-cockroachdb-auditing-cis-benchmark":3,"mdc-ldg4ih-key":39,"related-org-cockroachdb-auditing-cis-benchmark":1942,"related-repo-cockroachdb-auditing-cis-benchmark":2097},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":34,"sourceUrl":37,"mdContent":38},"auditing-cis-benchmark","audit CockroachDB clusters against CIS benchmarks","Audits a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 controls. Supports two audit depths — quick automated scans and full CIS audit procedures. Produces a structured PASS\u002FFAIL\u002FMANUAL report covering installation, system hardening, logging, user access, data protection, and CockroachDB settings. Use when preparing for CIS compliance assessments, hardening self-hosted deployments, or validating security posture against industry benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"cockroachdb","CockroachDB","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fcockroachdb.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Compliance","compliance",{"name":20,"slug":21,"type":15},"Audit","audit",{"name":23,"slug":24,"type":15},"Database","database",3,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin","2026-07-18T05:48:00.862384",null,2,[31,32,8,33],"claude","cockroach-cloud","developer-tools",{"repoUrl":26,"stars":25,"forks":29,"topics":35,"description":36},[31,32,8,33],"CockroachDB development plugin for Claude","https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin\u002Ftree\u002FHEAD\u002Fskills\u002Fcockroachdb-security-and-governance\u002Fauditing-cis-benchmark","---\nname: auditing-cis-benchmark\ndescription: Audits a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 controls. Supports two audit depths — quick automated scans and full CIS audit procedures. Produces a structured PASS\u002FFAIL\u002FMANUAL report covering installation, system hardening, logging, user access, data protection, and CockroachDB settings. Use when preparing for CIS compliance assessments, hardening self-hosted deployments, or validating security posture against industry benchmarks.\ncompatibility: \"CockroachDB self-hosted (all versions). Requires shell access to cluster nodes and SQL admin or VIEWACTIVITY privilege.\"\nmetadata:\n  author: cockroachdb\n  version: \"1.0\"\n---\n\n# Auditing CIS Benchmark Compliance\n\nAssesses a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 profile. Evaluates 30 controls across six domains: installation and patches, system hardening and topology, logging and monitoring, user access and authorization, data protection, and CockroachDB settings. Produces a structured report with PASS, FAIL, and MANUAL REVIEW findings, including CIS Controls v7\u002Fv8 mappings with Implementation Group coverage.\n\n**Scope:** Self-hosted CockroachDB deployments only. For CockroachDB Cloud clusters, use [auditing-cloud-cluster-security](..\u002Fauditing-cloud-cluster-security\u002FSKILL.md) instead — Cloud clusters have managed controls that supersede many CIS self-hosted checks.\n\n**Authoritative source:** This skill implements the benchmark defined at https:\u002F\u002Fgithub.com\u002Fcockroachlabs\u002FCIS-benchmarks-crdb\n\n**Read-only audit:** All operations are read-only. No cluster state, OS configuration, or files are modified during the assessment.\n\n## When to Use This Skill\n\n- Preparing for a CIS benchmark compliance assessment or external audit\n- Hardening a new self-hosted CockroachDB production deployment\n- Validating security posture against industry-standard benchmarks\n- Performing periodic compliance checks as part of security operations\n- Mapping CockroachDB security controls to CIS Controls frameworks\n- Responding to auditor requests for CIS benchmark evidence\n\n## Prerequisites\n\n**Access requirements:**\n\n| Requirement | Purpose |\n|-------------|---------|\n| SSH\u002Fshell access to cluster nodes | OS-level checks (systemd, swap, THP, file descriptors, certs) |\n| SQL access (admin or VIEWACTIVITY) | Cluster settings, user\u002Frole audit, logging config |\n| Access to systemd service files | Service configuration verification |\n| Access to certificate directory | Certificate permission and validity checks |\n\n**Tools:**\n\n| Tool | Required | Purpose |\n|------|----------|---------|\n| `cockroach` CLI | Yes | Version check, cert inspection, SQL access |\n| `systemctl` | Yes | Service status, NTP verification |\n| `openssl` | Recommended | Certificate validation and expiry checks |\n| Standard Unix tools | Yes | `ps`, `ls`, `cat`, `grep`, `swapon`, `ulimit` |\n\n## Audit Depth\n\nThis skill supports two audit depths. Choose based on your needs:\n\n| Depth | When to Use | What It Does |\n|-------|-------------|--------------|\n| **Quick Scan** | Periodic checks, CI\u002FCD gates, rapid triage | Runs one-liner shell\u002FSQL commands per control, returns pass\u002Ffail |\n| **Full Audit** | Compliance evidence, external auditor requests, thorough assessments | Multi-step procedures per control from the official CIS benchmark |\n\nAt Step 0, confirm which depth the user wants. Both depths can be combined — run the quick scan first to identify failures, then run the full audit on those failures for evidence collection.\n\n## CIS Benchmark Structure\n\nThe CIS CockroachDB Benchmark v1.0.0 Level 1 profile contains 30 controls organized into six sections:\n\n| Section | Domain | Controls | Automated | Manual |\n|---------|--------|----------|-----------|--------|\n| 1 | Installation and Patches | 1.1–1.7 (7) | 3 | 4 |\n| 2 | System Hardening and Topology | 2.1–2.7 (7) | 5 | 2 |\n| 3 | Logging and Monitoring | 3.1–3.4 (4) | 1 | 3 |\n| 4 | User Access and Authorization | 4.1–4.4 (4) | 0 | 4 |\n| 5 | Data Protection | 5.1–5.3 (3) | 0 | 3 |\n| 6 | CockroachDB Settings | 6.1–6.5 (5) | 1 | 4 |\n\nSee [CIS controls reference](references\u002Fcis-controls.md) for full control definitions with both quick scan commands and full audit procedures.\n\n## Assessment Workflow\n\n### Step 0: Confirm Audit Scope\n\nBefore starting, confirm with the user:\n\n1. **Audit depth** — Quick scan, full audit, or both\n2. **Target nodes** — Which nodes to audit (all nodes recommended)\n3. **CockroachDB service account** — Username running CockroachDB (default: `cockroach`)\n4. **Certificate directory** — Path to TLS certificates (default: `\u002Fvar\u002Flib\u002Fcockroach\u002Fcerts`)\n5. **Data directory** — Path to CockroachDB data store (default: `\u002Fvar\u002Flib\u002Fcockroach`)\n6. **Log directory** — Path to logs (default: `\u002Fvar\u002Flib\u002Fcockroach\u002Flogs` or `\u003Cstore>\u002Flogs`)\n7. **Enterprise license** — Whether Enterprise features (EAR) are available\n\nRecord these values — they parameterize the checks below.\n\n### Step 1: Installation and Patches (Controls 1.1–1.7)\n\nThese controls verify binary integrity, systemd service management, TLS initialization, version uniformity, upgrade processes, and encryption at rest.\n\n**Key checks:**\n- 1.1: Binary downloaded from official source, SHA-256 verified (Manual)\n- 1.2: `systemctl is-enabled cockroach.service` → `enabled` (Automated)\n- 1.3: No `--insecure` flag; certs directory exists with valid CA-signed certs (Automated)\n- 1.4: `ps aux | grep -c insecure` → `0` (Automated)\n- 1.5: All nodes run same version — quick scan via `cockroach version`, full audit via DB Console Node List and `crdb_internal.gossip_nodes` (Automated)\n- 1.6: Rolling upgrade runbook exists and has been tested (Manual)\n- 1.7: `--enterprise-encryption` configured with external KMS, keys not on disk (Manual)\n\n### Step 2: System Hardening and Topology (Controls 2.1–2.7)\n\nThese controls verify OS-level configuration: time synchronization, process isolation, network segmentation, memory settings, file descriptors, and privilege restrictions.\n\n**Key checks (run on each node):**\n- 2.1: NTP\u002Fchrony active, offsets below `--max-offset` (Automated)\n- 2.2: One CockroachDB process per host (Automated)\n- 2.3: Dedicated subnet with restricted ingress on ports 26257\u002F8080 (Manual)\n- 2.4: `swapon --show | wc -l` → `0` (Automated)\n- 2.5: THP set to `madvise` or `never` (Automated)\n- 2.6: File descriptor limit ≥ 15,000 for cockroach user (Automated)\n- 2.7: cockroach user has no sudo privileges (Automated)\n\n### Step 3: Logging and Monitoring (Controls 3.1–3.4)\n\nThese controls verify logging configuration, rotation, authentication event capture, and monitoring\u002Falerting.\n\n**Key checks:**\n- 3.1: Log directory exists, owned by cockroach, permissions 700 (Manual)\n- 3.2: Log rotation configured via CockroachDB config or logrotate (Manual)\n- 3.3: Both `server.auth_log.sql_connections.enabled` AND `server.auth_log.sql_sessions.enabled` = `true` (Automated)\n- 3.4: Monitoring system scraping metrics, alerts configured (Manual)\n\n### Step 4: User Access and Authorization (Controls 4.1–4.4)\n\nThese controls verify host-based authentication, password security, root user hardening, and centralized identity management.\n\n> ⚠️ **Control 4.2 (Full Audit only):** Inspecting stored password hashes requires `SET allow_unsafe_internals = true`. This is a break-glass, audit-only operation — run only in a dedicated admin session by authorized operators, and reset immediately after with `SET allow_unsafe_internals = false`. Do not expose this to application workloads.\n\n**Key checks (all SQL):**\n- 4.1: HBA has specific IP ranges, strong auth methods, reject catch-all (Manual)\n- 4.2: `password_encryption` = `scram-sha-256`, stored hashes are SCRAM format (Manual)\n- 4.3: Root restricted to specific hosts via HBA with cert method, activity audited (Manual)\n- 4.4: OIDC\u002FLDAP enabled, identity mapping configured, local accounts minimized (Manual)\n\n### Step 5: Data Protection (Controls 5.1–5.3)\n\nThese controls verify backup encryption, recovery testing, and multi-region data localization.\n\n**Key checks:**\n- 5.1: Backups use `kms` or `encryption_passphrase`, or storage-layer encryption enforced (Manual)\n- 5.2: Recovery procedures tested quarterly with documented results (Manual)\n- 5.3: Multi-region tables use `REGIONAL BY ROW` or zone constraints for data residency (Manual)\n\n### Step 6: CockroachDB Settings (Controls 6.1–6.5)\n\nThese controls verify certificate security, setting redaction, audit logging, session timeouts, and OCSP.\n\n**Key checks:**\n- 6.1: Private key permissions `0600`, certs valid 90+ days (Automated)\n- 6.2: Debug bundles use `--redact`, no secrets in logs (Manual)\n- 6.3: `sql.log.user_audit` non-empty, `sql.log.admin_audit.enabled` = `true`, security channels configured (Manual)\n- 6.4: `sql.defaults.idle_in_session_timeout` set (e.g., `15m`) (Manual)\n- 6.5: `security.ocsp.mode` = `strict` or `lax` (Manual)\n\n## Report Format\n\nGenerate a markdown report following the structure in [sample report](references\u002Fsample-report.md).\n\n**Status markers:**\n- `[PASS]` — Control is satisfied\n- `[FAIL]` — Control is not satisfied, remediation required\n- `[MANUAL]` — Requires human review; automated check cannot determine compliance\n- `[N\u002FA]` — Control does not apply (e.g., EAR without Enterprise license)\n\n## Relationship to Other Security Skills\n\n| CIS Section | Related Remediation Skills |\n|-------------|---------------------------|\n| 1 Installation | [managing-tls-certificates](..\u002Fmanaging-tls-certificates\u002FSKILL.md), [enabling-cmek-encryption](..\u002Fenabling-cmek-encryption\u002FSKILL.md) |\n| 3 Logging | [configuring-audit-logging](..\u002Fconfiguring-audit-logging\u002FSKILL.md), [configuring-log-export](..\u002Fconfiguring-log-export\u002FSKILL.md) |\n| 4 User Access | [hardening-user-privileges](..\u002Fhardening-user-privileges\u002FSKILL.md), [enforcing-password-policies](..\u002Fenforcing-password-policies\u002FSKILL.md), [configuring-sso-and-scim](..\u002Fconfiguring-sso-and-scim\u002FSKILL.md) |\n| 5 Data Protection | [preparing-compliance-documentation](..\u002Fpreparing-compliance-documentation\u002FSKILL.md) |\n| 6 Settings | [managing-tls-certificates](..\u002Fmanaging-tls-certificates\u002FSKILL.md), [configuring-audit-logging](..\u002Fconfiguring-audit-logging\u002FSKILL.md) |\n\nFor a broader security posture assessment (covering Cloud and self-hosted), use [auditing-cloud-cluster-security](..\u002Fauditing-cloud-cluster-security\u002FSKILL.md).\n\n## Safety Considerations\n\n- **All operations are read-only.** No cluster settings, OS configuration, or files are modified.\n- **Shell commands use read-only tools:** `ps`, `ls`, `cat`, `grep`, `systemctl is-enabled\u002Fis-active`, `swapon --show`, `ulimit`, `openssl x509`, `openssl verify`.\n- **SQL queries use SHOW and SELECT only.** No DDL or DML statements.\n- **One exception (4.2):** The full audit procedure for password hash inspection requires `SET allow_unsafe_internals = true` — this is a read-only break-glass operation that must be reset immediately after (`SET allow_unsafe_internals = false`). Only authorized operators should run this step.\n- **No secrets are logged.** Certificate private keys and passwords are not included in report output.\n- **Privilege check:** Some SQL queries require admin or VIEWACTIVITY privilege. The report notes any permission gaps.\n\n## References\n\n**Skill references:**\n- [CIS controls reference](references\u002Fcis-controls.md) — All 30 controls with quick scan commands and full audit procedures\n- [SQL queries for CIS audit](references\u002Fsql-queries.md) — All SQL queries used in the assessment\n- [Sample audit report](references\u002Fsample-report.md) — Example report with findings\n\n**Authoritative source:**\n- [CIS CockroachDB Benchmark (official repo)](https:\u002F\u002Fgithub.com\u002Fcockroachlabs\u002FCIS-benchmarks-crdb)\n\n**Related skills:**\n- [auditing-cloud-cluster-security](..\u002Fauditing-cloud-cluster-security\u002FSKILL.md) — Broader security posture assessment\n- [configuring-audit-logging](..\u002Fconfiguring-audit-logging\u002FSKILL.md) — SQL audit logging setup\n- [hardening-user-privileges](..\u002Fhardening-user-privileges\u002FSKILL.md) — RBAC tightening\n- [enforcing-password-policies](..\u002Fenforcing-password-policies\u002FSKILL.md) — Password policy enforcement\n- [managing-tls-certificates](..\u002Fmanaging-tls-certificates\u002FSKILL.md) — TLS certificate management\n- [enabling-cmek-encryption](..\u002Fenabling-cmek-encryption\u002FSKILL.md) — Encryption at rest\n- [configuring-sso-and-scim](..\u002Fconfiguring-sso-and-scim\u002FSKILL.md) — SSO and SCIM provisioning\n\n**Official CockroachDB documentation:**\n- [Security Overview](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Fsecurity-overview.html)\n- [Recommended Production Settings](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Frecommended-production-settings.html)\n- [Releases](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Freleases\u002F)\n- [Security Advisories](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fadvisories\u002F)",{"data":40,"body":44},{"name":4,"description":6,"compatibility":41,"metadata":42},"CockroachDB self-hosted (all versions). Requires shell access to cluster nodes and SQL admin or VIEWACTIVITY privilege.",{"author":8,"version":43},"1.0",{"type":45,"children":46},"root",[47,56,62,82,99,109,116,151,157,165,245,253,404,410,415,484,489,495,500,694,707,713,720,725,835,840,846,851,859,957,963,968,976,1048,1054,1059,1066,1112,1118,1123,1155,1163,1201,1207,1212,1219,1260,1266,1271,1278,1382,1388,1401,1409,1456,1462,1600,1610,1616,1751,1757,1765,1798,1805,1817,1825,1891,1899],{"type":48,"tag":49,"props":50,"children":52},"element","h1",{"id":51},"auditing-cis-benchmark-compliance",[53],{"type":54,"value":55},"text","Auditing CIS Benchmark Compliance",{"type":48,"tag":57,"props":58,"children":59},"p",{},[60],{"type":54,"value":61},"Assesses a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 profile. Evaluates 30 controls across six domains: installation and patches, system hardening and topology, logging and monitoring, user access and authorization, data protection, and CockroachDB settings. Produces a structured report with PASS, FAIL, and MANUAL REVIEW findings, including CIS Controls v7\u002Fv8 mappings with Implementation Group coverage.",{"type":48,"tag":57,"props":63,"children":64},{},[65,71,73,80],{"type":48,"tag":66,"props":67,"children":68},"strong",{},[69],{"type":54,"value":70},"Scope:",{"type":54,"value":72}," Self-hosted CockroachDB deployments only. For CockroachDB Cloud clusters, use ",{"type":48,"tag":74,"props":75,"children":77},"a",{"href":76},"..\u002Fauditing-cloud-cluster-security\u002FSKILL.md",[78],{"type":54,"value":79},"auditing-cloud-cluster-security",{"type":54,"value":81}," instead — Cloud clusters have managed controls that supersede many CIS self-hosted checks.",{"type":48,"tag":57,"props":83,"children":84},{},[85,90,92],{"type":48,"tag":66,"props":86,"children":87},{},[88],{"type":54,"value":89},"Authoritative source:",{"type":54,"value":91}," This skill implements the benchmark defined at ",{"type":48,"tag":74,"props":93,"children":97},{"href":94,"rel":95},"https:\u002F\u002Fgithub.com\u002Fcockroachlabs\u002FCIS-benchmarks-crdb",[96],"nofollow",[98],{"type":54,"value":94},{"type":48,"tag":57,"props":100,"children":101},{},[102,107],{"type":48,"tag":66,"props":103,"children":104},{},[105],{"type":54,"value":106},"Read-only audit:",{"type":54,"value":108}," All operations are read-only. No cluster state, OS configuration, or files are modified during the assessment.",{"type":48,"tag":110,"props":111,"children":113},"h2",{"id":112},"when-to-use-this-skill",[114],{"type":54,"value":115},"When to Use This Skill",{"type":48,"tag":117,"props":118,"children":119},"ul",{},[120,126,131,136,141,146],{"type":48,"tag":121,"props":122,"children":123},"li",{},[124],{"type":54,"value":125},"Preparing for a CIS benchmark compliance assessment or external audit",{"type":48,"tag":121,"props":127,"children":128},{},[129],{"type":54,"value":130},"Hardening a new self-hosted CockroachDB production deployment",{"type":48,"tag":121,"props":132,"children":133},{},[134],{"type":54,"value":135},"Validating security posture against industry-standard benchmarks",{"type":48,"tag":121,"props":137,"children":138},{},[139],{"type":54,"value":140},"Performing periodic compliance checks as part of security operations",{"type":48,"tag":121,"props":142,"children":143},{},[144],{"type":54,"value":145},"Mapping CockroachDB security controls to CIS Controls frameworks",{"type":48,"tag":121,"props":147,"children":148},{},[149],{"type":54,"value":150},"Responding to auditor requests for CIS benchmark evidence",{"type":48,"tag":110,"props":152,"children":154},{"id":153},"prerequisites",[155],{"type":54,"value":156},"Prerequisites",{"type":48,"tag":57,"props":158,"children":159},{},[160],{"type":48,"tag":66,"props":161,"children":162},{},[163],{"type":54,"value":164},"Access requirements:",{"type":48,"tag":166,"props":167,"children":168},"table",{},[169,188],{"type":48,"tag":170,"props":171,"children":172},"thead",{},[173],{"type":48,"tag":174,"props":175,"children":176},"tr",{},[177,183],{"type":48,"tag":178,"props":179,"children":180},"th",{},[181],{"type":54,"value":182},"Requirement",{"type":48,"tag":178,"props":184,"children":185},{},[186],{"type":54,"value":187},"Purpose",{"type":48,"tag":189,"props":190,"children":191},"tbody",{},[192,206,219,232],{"type":48,"tag":174,"props":193,"children":194},{},[195,201],{"type":48,"tag":196,"props":197,"children":198},"td",{},[199],{"type":54,"value":200},"SSH\u002Fshell access to cluster nodes",{"type":48,"tag":196,"props":202,"children":203},{},[204],{"type":54,"value":205},"OS-level checks (systemd, swap, THP, file descriptors, certs)",{"type":48,"tag":174,"props":207,"children":208},{},[209,214],{"type":48,"tag":196,"props":210,"children":211},{},[212],{"type":54,"value":213},"SQL access (admin or VIEWACTIVITY)",{"type":48,"tag":196,"props":215,"children":216},{},[217],{"type":54,"value":218},"Cluster settings, user\u002Frole audit, logging config",{"type":48,"tag":174,"props":220,"children":221},{},[222,227],{"type":48,"tag":196,"props":223,"children":224},{},[225],{"type":54,"value":226},"Access to systemd service files",{"type":48,"tag":196,"props":228,"children":229},{},[230],{"type":54,"value":231},"Service configuration verification",{"type":48,"tag":174,"props":233,"children":234},{},[235,240],{"type":48,"tag":196,"props":236,"children":237},{},[238],{"type":54,"value":239},"Access to certificate directory",{"type":48,"tag":196,"props":241,"children":242},{},[243],{"type":54,"value":244},"Certificate permission and validity checks",{"type":48,"tag":57,"props":246,"children":247},{},[248],{"type":48,"tag":66,"props":249,"children":250},{},[251],{"type":54,"value":252},"Tools:",{"type":48,"tag":166,"props":254,"children":255},{},[256,276],{"type":48,"tag":170,"props":257,"children":258},{},[259],{"type":48,"tag":174,"props":260,"children":261},{},[262,267,272],{"type":48,"tag":178,"props":263,"children":264},{},[265],{"type":54,"value":266},"Tool",{"type":48,"tag":178,"props":268,"children":269},{},[270],{"type":54,"value":271},"Required",{"type":48,"tag":178,"props":273,"children":274},{},[275],{"type":54,"value":187},{"type":48,"tag":189,"props":277,"children":278},{},[279,304,325,347],{"type":48,"tag":174,"props":280,"children":281},{},[282,294,299],{"type":48,"tag":196,"props":283,"children":284},{},[285,292],{"type":48,"tag":286,"props":287,"children":289},"code",{"className":288},[],[290],{"type":54,"value":291},"cockroach",{"type":54,"value":293}," CLI",{"type":48,"tag":196,"props":295,"children":296},{},[297],{"type":54,"value":298},"Yes",{"type":48,"tag":196,"props":300,"children":301},{},[302],{"type":54,"value":303},"Version check, cert inspection, SQL access",{"type":48,"tag":174,"props":305,"children":306},{},[307,316,320],{"type":48,"tag":196,"props":308,"children":309},{},[310],{"type":48,"tag":286,"props":311,"children":313},{"className":312},[],[314],{"type":54,"value":315},"systemctl",{"type":48,"tag":196,"props":317,"children":318},{},[319],{"type":54,"value":298},{"type":48,"tag":196,"props":321,"children":322},{},[323],{"type":54,"value":324},"Service status, NTP verification",{"type":48,"tag":174,"props":326,"children":327},{},[328,337,342],{"type":48,"tag":196,"props":329,"children":330},{},[331],{"type":48,"tag":286,"props":332,"children":334},{"className":333},[],[335],{"type":54,"value":336},"openssl",{"type":48,"tag":196,"props":338,"children":339},{},[340],{"type":54,"value":341},"Recommended",{"type":48,"tag":196,"props":343,"children":344},{},[345],{"type":54,"value":346},"Certificate validation and expiry checks",{"type":48,"tag":174,"props":348,"children":349},{},[350,355,359],{"type":48,"tag":196,"props":351,"children":352},{},[353],{"type":54,"value":354},"Standard Unix tools",{"type":48,"tag":196,"props":356,"children":357},{},[358],{"type":54,"value":298},{"type":48,"tag":196,"props":360,"children":361},{},[362,368,370,376,377,383,384,390,391,397,398],{"type":48,"tag":286,"props":363,"children":365},{"className":364},[],[366],{"type":54,"value":367},"ps",{"type":54,"value":369},", ",{"type":48,"tag":286,"props":371,"children":373},{"className":372},[],[374],{"type":54,"value":375},"ls",{"type":54,"value":369},{"type":48,"tag":286,"props":378,"children":380},{"className":379},[],[381],{"type":54,"value":382},"cat",{"type":54,"value":369},{"type":48,"tag":286,"props":385,"children":387},{"className":386},[],[388],{"type":54,"value":389},"grep",{"type":54,"value":369},{"type":48,"tag":286,"props":392,"children":394},{"className":393},[],[395],{"type":54,"value":396},"swapon",{"type":54,"value":369},{"type":48,"tag":286,"props":399,"children":401},{"className":400},[],[402],{"type":54,"value":403},"ulimit",{"type":48,"tag":110,"props":405,"children":407},{"id":406},"audit-depth",[408],{"type":54,"value":409},"Audit Depth",{"type":48,"tag":57,"props":411,"children":412},{},[413],{"type":54,"value":414},"This skill supports two audit depths. Choose based on your needs:",{"type":48,"tag":166,"props":416,"children":417},{},[418,439],{"type":48,"tag":170,"props":419,"children":420},{},[421],{"type":48,"tag":174,"props":422,"children":423},{},[424,429,434],{"type":48,"tag":178,"props":425,"children":426},{},[427],{"type":54,"value":428},"Depth",{"type":48,"tag":178,"props":430,"children":431},{},[432],{"type":54,"value":433},"When to Use",{"type":48,"tag":178,"props":435,"children":436},{},[437],{"type":54,"value":438},"What It Does",{"type":48,"tag":189,"props":440,"children":441},{},[442,463],{"type":48,"tag":174,"props":443,"children":444},{},[445,453,458],{"type":48,"tag":196,"props":446,"children":447},{},[448],{"type":48,"tag":66,"props":449,"children":450},{},[451],{"type":54,"value":452},"Quick Scan",{"type":48,"tag":196,"props":454,"children":455},{},[456],{"type":54,"value":457},"Periodic checks, CI\u002FCD gates, rapid triage",{"type":48,"tag":196,"props":459,"children":460},{},[461],{"type":54,"value":462},"Runs one-liner shell\u002FSQL commands per control, returns pass\u002Ffail",{"type":48,"tag":174,"props":464,"children":465},{},[466,474,479],{"type":48,"tag":196,"props":467,"children":468},{},[469],{"type":48,"tag":66,"props":470,"children":471},{},[472],{"type":54,"value":473},"Full Audit",{"type":48,"tag":196,"props":475,"children":476},{},[477],{"type":54,"value":478},"Compliance evidence, external auditor requests, thorough assessments",{"type":48,"tag":196,"props":480,"children":481},{},[482],{"type":54,"value":483},"Multi-step procedures per control from the official CIS benchmark",{"type":48,"tag":57,"props":485,"children":486},{},[487],{"type":54,"value":488},"At Step 0, confirm which depth the user wants. Both depths can be combined — run the quick scan first to identify failures, then run the full audit on those failures for evidence collection.",{"type":48,"tag":110,"props":490,"children":492},{"id":491},"cis-benchmark-structure",[493],{"type":54,"value":494},"CIS Benchmark Structure",{"type":48,"tag":57,"props":496,"children":497},{},[498],{"type":54,"value":499},"The CIS CockroachDB Benchmark v1.0.0 Level 1 profile contains 30 controls organized into six sections:",{"type":48,"tag":166,"props":501,"children":502},{},[503,534],{"type":48,"tag":170,"props":504,"children":505},{},[506],{"type":48,"tag":174,"props":507,"children":508},{},[509,514,519,524,529],{"type":48,"tag":178,"props":510,"children":511},{},[512],{"type":54,"value":513},"Section",{"type":48,"tag":178,"props":515,"children":516},{},[517],{"type":54,"value":518},"Domain",{"type":48,"tag":178,"props":520,"children":521},{},[522],{"type":54,"value":523},"Controls",{"type":48,"tag":178,"props":525,"children":526},{},[527],{"type":54,"value":528},"Automated",{"type":48,"tag":178,"props":530,"children":531},{},[532],{"type":54,"value":533},"Manual",{"type":48,"tag":189,"props":535,"children":536},{},[537,565,592,617,643,668],{"type":48,"tag":174,"props":538,"children":539},{},[540,545,550,555,560],{"type":48,"tag":196,"props":541,"children":542},{},[543],{"type":54,"value":544},"1",{"type":48,"tag":196,"props":546,"children":547},{},[548],{"type":54,"value":549},"Installation and Patches",{"type":48,"tag":196,"props":551,"children":552},{},[553],{"type":54,"value":554},"1.1–1.7 (7)",{"type":48,"tag":196,"props":556,"children":557},{},[558],{"type":54,"value":559},"3",{"type":48,"tag":196,"props":561,"children":562},{},[563],{"type":54,"value":564},"4",{"type":48,"tag":174,"props":566,"children":567},{},[568,573,578,583,588],{"type":48,"tag":196,"props":569,"children":570},{},[571],{"type":54,"value":572},"2",{"type":48,"tag":196,"props":574,"children":575},{},[576],{"type":54,"value":577},"System Hardening and Topology",{"type":48,"tag":196,"props":579,"children":580},{},[581],{"type":54,"value":582},"2.1–2.7 (7)",{"type":48,"tag":196,"props":584,"children":585},{},[586],{"type":54,"value":587},"5",{"type":48,"tag":196,"props":589,"children":590},{},[591],{"type":54,"value":572},{"type":48,"tag":174,"props":593,"children":594},{},[595,599,604,609,613],{"type":48,"tag":196,"props":596,"children":597},{},[598],{"type":54,"value":559},{"type":48,"tag":196,"props":600,"children":601},{},[602],{"type":54,"value":603},"Logging and Monitoring",{"type":48,"tag":196,"props":605,"children":606},{},[607],{"type":54,"value":608},"3.1–3.4 (4)",{"type":48,"tag":196,"props":610,"children":611},{},[612],{"type":54,"value":544},{"type":48,"tag":196,"props":614,"children":615},{},[616],{"type":54,"value":559},{"type":48,"tag":174,"props":618,"children":619},{},[620,624,629,634,639],{"type":48,"tag":196,"props":621,"children":622},{},[623],{"type":54,"value":564},{"type":48,"tag":196,"props":625,"children":626},{},[627],{"type":54,"value":628},"User Access and Authorization",{"type":48,"tag":196,"props":630,"children":631},{},[632],{"type":54,"value":633},"4.1–4.4 (4)",{"type":48,"tag":196,"props":635,"children":636},{},[637],{"type":54,"value":638},"0",{"type":48,"tag":196,"props":640,"children":641},{},[642],{"type":54,"value":564},{"type":48,"tag":174,"props":644,"children":645},{},[646,650,655,660,664],{"type":48,"tag":196,"props":647,"children":648},{},[649],{"type":54,"value":587},{"type":48,"tag":196,"props":651,"children":652},{},[653],{"type":54,"value":654},"Data Protection",{"type":48,"tag":196,"props":656,"children":657},{},[658],{"type":54,"value":659},"5.1–5.3 (3)",{"type":48,"tag":196,"props":661,"children":662},{},[663],{"type":54,"value":638},{"type":48,"tag":196,"props":665,"children":666},{},[667],{"type":54,"value":559},{"type":48,"tag":174,"props":669,"children":670},{},[671,676,681,686,690],{"type":48,"tag":196,"props":672,"children":673},{},[674],{"type":54,"value":675},"6",{"type":48,"tag":196,"props":677,"children":678},{},[679],{"type":54,"value":680},"CockroachDB Settings",{"type":48,"tag":196,"props":682,"children":683},{},[684],{"type":54,"value":685},"6.1–6.5 (5)",{"type":48,"tag":196,"props":687,"children":688},{},[689],{"type":54,"value":544},{"type":48,"tag":196,"props":691,"children":692},{},[693],{"type":54,"value":564},{"type":48,"tag":57,"props":695,"children":696},{},[697,699,705],{"type":54,"value":698},"See ",{"type":48,"tag":74,"props":700,"children":702},{"href":701},"references\u002Fcis-controls.md",[703],{"type":54,"value":704},"CIS controls reference",{"type":54,"value":706}," for full control definitions with both quick scan commands and full audit procedures.",{"type":48,"tag":110,"props":708,"children":710},{"id":709},"assessment-workflow",[711],{"type":54,"value":712},"Assessment Workflow",{"type":48,"tag":714,"props":715,"children":717},"h3",{"id":716},"step-0-confirm-audit-scope",[718],{"type":54,"value":719},"Step 0: Confirm Audit Scope",{"type":48,"tag":57,"props":721,"children":722},{},[723],{"type":54,"value":724},"Before starting, confirm with the user:",{"type":48,"tag":726,"props":727,"children":728},"ol",{},[729,739,749,766,783,800,825],{"type":48,"tag":121,"props":730,"children":731},{},[732,737],{"type":48,"tag":66,"props":733,"children":734},{},[735],{"type":54,"value":736},"Audit depth",{"type":54,"value":738}," — Quick scan, full audit, or both",{"type":48,"tag":121,"props":740,"children":741},{},[742,747],{"type":48,"tag":66,"props":743,"children":744},{},[745],{"type":54,"value":746},"Target nodes",{"type":54,"value":748}," — Which nodes to audit (all nodes recommended)",{"type":48,"tag":121,"props":750,"children":751},{},[752,757,759,764],{"type":48,"tag":66,"props":753,"children":754},{},[755],{"type":54,"value":756},"CockroachDB service account",{"type":54,"value":758}," — Username running CockroachDB (default: ",{"type":48,"tag":286,"props":760,"children":762},{"className":761},[],[763],{"type":54,"value":291},{"type":54,"value":765},")",{"type":48,"tag":121,"props":767,"children":768},{},[769,774,776,782],{"type":48,"tag":66,"props":770,"children":771},{},[772],{"type":54,"value":773},"Certificate directory",{"type":54,"value":775}," — Path to TLS certificates (default: ",{"type":48,"tag":286,"props":777,"children":779},{"className":778},[],[780],{"type":54,"value":781},"\u002Fvar\u002Flib\u002Fcockroach\u002Fcerts",{"type":54,"value":765},{"type":48,"tag":121,"props":784,"children":785},{},[786,791,793,799],{"type":48,"tag":66,"props":787,"children":788},{},[789],{"type":54,"value":790},"Data directory",{"type":54,"value":792}," — Path to CockroachDB data store (default: ",{"type":48,"tag":286,"props":794,"children":796},{"className":795},[],[797],{"type":54,"value":798},"\u002Fvar\u002Flib\u002Fcockroach",{"type":54,"value":765},{"type":48,"tag":121,"props":801,"children":802},{},[803,808,810,816,818,824],{"type":48,"tag":66,"props":804,"children":805},{},[806],{"type":54,"value":807},"Log directory",{"type":54,"value":809}," — Path to logs (default: ",{"type":48,"tag":286,"props":811,"children":813},{"className":812},[],[814],{"type":54,"value":815},"\u002Fvar\u002Flib\u002Fcockroach\u002Flogs",{"type":54,"value":817}," or ",{"type":48,"tag":286,"props":819,"children":821},{"className":820},[],[822],{"type":54,"value":823},"\u003Cstore>\u002Flogs",{"type":54,"value":765},{"type":48,"tag":121,"props":826,"children":827},{},[828,833],{"type":48,"tag":66,"props":829,"children":830},{},[831],{"type":54,"value":832},"Enterprise license",{"type":54,"value":834}," — Whether Enterprise features (EAR) are available",{"type":48,"tag":57,"props":836,"children":837},{},[838],{"type":54,"value":839},"Record these values — they parameterize the checks below.",{"type":48,"tag":714,"props":841,"children":843},{"id":842},"step-1-installation-and-patches-controls-1117",[844],{"type":54,"value":845},"Step 1: Installation and Patches (Controls 1.1–1.7)",{"type":48,"tag":57,"props":847,"children":848},{},[849],{"type":54,"value":850},"These controls verify binary integrity, systemd service management, TLS initialization, version uniformity, upgrade processes, and encryption at rest.",{"type":48,"tag":57,"props":852,"children":853},{},[854],{"type":48,"tag":66,"props":855,"children":856},{},[857],{"type":54,"value":858},"Key checks:",{"type":48,"tag":117,"props":860,"children":861},{},[862,867,888,901,919,939,944],{"type":48,"tag":121,"props":863,"children":864},{},[865],{"type":54,"value":866},"1.1: Binary downloaded from official source, SHA-256 verified (Manual)",{"type":48,"tag":121,"props":868,"children":869},{},[870,872,878,880,886],{"type":54,"value":871},"1.2: ",{"type":48,"tag":286,"props":873,"children":875},{"className":874},[],[876],{"type":54,"value":877},"systemctl is-enabled cockroach.service",{"type":54,"value":879}," → ",{"type":48,"tag":286,"props":881,"children":883},{"className":882},[],[884],{"type":54,"value":885},"enabled",{"type":54,"value":887}," (Automated)",{"type":48,"tag":121,"props":889,"children":890},{},[891,893,899],{"type":54,"value":892},"1.3: No ",{"type":48,"tag":286,"props":894,"children":896},{"className":895},[],[897],{"type":54,"value":898},"--insecure",{"type":54,"value":900}," flag; certs directory exists with valid CA-signed certs (Automated)",{"type":48,"tag":121,"props":902,"children":903},{},[904,906,912,913,918],{"type":54,"value":905},"1.4: ",{"type":48,"tag":286,"props":907,"children":909},{"className":908},[],[910],{"type":54,"value":911},"ps aux | grep -c insecure",{"type":54,"value":879},{"type":48,"tag":286,"props":914,"children":916},{"className":915},[],[917],{"type":54,"value":638},{"type":54,"value":887},{"type":48,"tag":121,"props":920,"children":921},{},[922,924,930,932,938],{"type":54,"value":923},"1.5: All nodes run same version — quick scan via ",{"type":48,"tag":286,"props":925,"children":927},{"className":926},[],[928],{"type":54,"value":929},"cockroach version",{"type":54,"value":931},", full audit via DB Console Node List and ",{"type":48,"tag":286,"props":933,"children":935},{"className":934},[],[936],{"type":54,"value":937},"crdb_internal.gossip_nodes",{"type":54,"value":887},{"type":48,"tag":121,"props":940,"children":941},{},[942],{"type":54,"value":943},"1.6: Rolling upgrade runbook exists and has been tested (Manual)",{"type":48,"tag":121,"props":945,"children":946},{},[947,949,955],{"type":54,"value":948},"1.7: ",{"type":48,"tag":286,"props":950,"children":952},{"className":951},[],[953],{"type":54,"value":954},"--enterprise-encryption",{"type":54,"value":956}," configured with external KMS, keys not on disk (Manual)",{"type":48,"tag":714,"props":958,"children":960},{"id":959},"step-2-system-hardening-and-topology-controls-2127",[961],{"type":54,"value":962},"Step 2: System Hardening and Topology (Controls 2.1–2.7)",{"type":48,"tag":57,"props":964,"children":965},{},[966],{"type":54,"value":967},"These controls verify OS-level configuration: time synchronization, process isolation, network segmentation, memory settings, file descriptors, and privilege restrictions.",{"type":48,"tag":57,"props":969,"children":970},{},[971],{"type":48,"tag":66,"props":972,"children":973},{},[974],{"type":54,"value":975},"Key checks (run on each node):",{"type":48,"tag":117,"props":977,"children":978},{},[979,991,996,1001,1019,1038,1043],{"type":48,"tag":121,"props":980,"children":981},{},[982,984,990],{"type":54,"value":983},"2.1: NTP\u002Fchrony active, offsets below ",{"type":48,"tag":286,"props":985,"children":987},{"className":986},[],[988],{"type":54,"value":989},"--max-offset",{"type":54,"value":887},{"type":48,"tag":121,"props":992,"children":993},{},[994],{"type":54,"value":995},"2.2: One CockroachDB process per host (Automated)",{"type":48,"tag":121,"props":997,"children":998},{},[999],{"type":54,"value":1000},"2.3: Dedicated subnet with restricted ingress on ports 26257\u002F8080 (Manual)",{"type":48,"tag":121,"props":1002,"children":1003},{},[1004,1006,1012,1013,1018],{"type":54,"value":1005},"2.4: ",{"type":48,"tag":286,"props":1007,"children":1009},{"className":1008},[],[1010],{"type":54,"value":1011},"swapon --show | wc -l",{"type":54,"value":879},{"type":48,"tag":286,"props":1014,"children":1016},{"className":1015},[],[1017],{"type":54,"value":638},{"type":54,"value":887},{"type":48,"tag":121,"props":1020,"children":1021},{},[1022,1024,1030,1031,1037],{"type":54,"value":1023},"2.5: THP set to ",{"type":48,"tag":286,"props":1025,"children":1027},{"className":1026},[],[1028],{"type":54,"value":1029},"madvise",{"type":54,"value":817},{"type":48,"tag":286,"props":1032,"children":1034},{"className":1033},[],[1035],{"type":54,"value":1036},"never",{"type":54,"value":887},{"type":48,"tag":121,"props":1039,"children":1040},{},[1041],{"type":54,"value":1042},"2.6: File descriptor limit ≥ 15,000 for cockroach user (Automated)",{"type":48,"tag":121,"props":1044,"children":1045},{},[1046],{"type":54,"value":1047},"2.7: cockroach user has no sudo privileges (Automated)",{"type":48,"tag":714,"props":1049,"children":1051},{"id":1050},"step-3-logging-and-monitoring-controls-3134",[1052],{"type":54,"value":1053},"Step 3: Logging and Monitoring (Controls 3.1–3.4)",{"type":48,"tag":57,"props":1055,"children":1056},{},[1057],{"type":54,"value":1058},"These controls verify logging configuration, rotation, authentication event capture, and monitoring\u002Falerting.",{"type":48,"tag":57,"props":1060,"children":1061},{},[1062],{"type":48,"tag":66,"props":1063,"children":1064},{},[1065],{"type":54,"value":858},{"type":48,"tag":117,"props":1067,"children":1068},{},[1069,1074,1079,1107],{"type":48,"tag":121,"props":1070,"children":1071},{},[1072],{"type":54,"value":1073},"3.1: Log directory exists, owned by cockroach, permissions 700 (Manual)",{"type":48,"tag":121,"props":1075,"children":1076},{},[1077],{"type":54,"value":1078},"3.2: Log rotation configured via CockroachDB config or logrotate (Manual)",{"type":48,"tag":121,"props":1080,"children":1081},{},[1082,1084,1090,1092,1098,1100,1106],{"type":54,"value":1083},"3.3: Both ",{"type":48,"tag":286,"props":1085,"children":1087},{"className":1086},[],[1088],{"type":54,"value":1089},"server.auth_log.sql_connections.enabled",{"type":54,"value":1091}," AND ",{"type":48,"tag":286,"props":1093,"children":1095},{"className":1094},[],[1096],{"type":54,"value":1097},"server.auth_log.sql_sessions.enabled",{"type":54,"value":1099}," = ",{"type":48,"tag":286,"props":1101,"children":1103},{"className":1102},[],[1104],{"type":54,"value":1105},"true",{"type":54,"value":887},{"type":48,"tag":121,"props":1108,"children":1109},{},[1110],{"type":54,"value":1111},"3.4: Monitoring system scraping metrics, alerts configured (Manual)",{"type":48,"tag":714,"props":1113,"children":1115},{"id":1114},"step-4-user-access-and-authorization-controls-4144",[1116],{"type":54,"value":1117},"Step 4: User Access and Authorization (Controls 4.1–4.4)",{"type":48,"tag":57,"props":1119,"children":1120},{},[1121],{"type":54,"value":1122},"These controls verify host-based authentication, password security, root user hardening, and centralized identity management.",{"type":48,"tag":1124,"props":1125,"children":1126},"blockquote",{},[1127],{"type":48,"tag":57,"props":1128,"children":1129},{},[1130,1132,1137,1139,1145,1147,1153],{"type":54,"value":1131},"⚠️ ",{"type":48,"tag":66,"props":1133,"children":1134},{},[1135],{"type":54,"value":1136},"Control 4.2 (Full Audit only):",{"type":54,"value":1138}," Inspecting stored password hashes requires ",{"type":48,"tag":286,"props":1140,"children":1142},{"className":1141},[],[1143],{"type":54,"value":1144},"SET allow_unsafe_internals = true",{"type":54,"value":1146},". This is a break-glass, audit-only operation — run only in a dedicated admin session by authorized operators, and reset immediately after with ",{"type":48,"tag":286,"props":1148,"children":1150},{"className":1149},[],[1151],{"type":54,"value":1152},"SET allow_unsafe_internals = false",{"type":54,"value":1154},". Do not expose this to application workloads.",{"type":48,"tag":57,"props":1156,"children":1157},{},[1158],{"type":48,"tag":66,"props":1159,"children":1160},{},[1161],{"type":54,"value":1162},"Key checks (all SQL):",{"type":48,"tag":117,"props":1164,"children":1165},{},[1166,1171,1191,1196],{"type":48,"tag":121,"props":1167,"children":1168},{},[1169],{"type":54,"value":1170},"4.1: HBA has specific IP ranges, strong auth methods, reject catch-all (Manual)",{"type":48,"tag":121,"props":1172,"children":1173},{},[1174,1176,1182,1183,1189],{"type":54,"value":1175},"4.2: ",{"type":48,"tag":286,"props":1177,"children":1179},{"className":1178},[],[1180],{"type":54,"value":1181},"password_encryption",{"type":54,"value":1099},{"type":48,"tag":286,"props":1184,"children":1186},{"className":1185},[],[1187],{"type":54,"value":1188},"scram-sha-256",{"type":54,"value":1190},", stored hashes are SCRAM format (Manual)",{"type":48,"tag":121,"props":1192,"children":1193},{},[1194],{"type":54,"value":1195},"4.3: Root restricted to specific hosts via HBA with cert method, activity audited (Manual)",{"type":48,"tag":121,"props":1197,"children":1198},{},[1199],{"type":54,"value":1200},"4.4: OIDC\u002FLDAP enabled, identity mapping configured, local accounts minimized (Manual)",{"type":48,"tag":714,"props":1202,"children":1204},{"id":1203},"step-5-data-protection-controls-5153",[1205],{"type":54,"value":1206},"Step 5: Data Protection (Controls 5.1–5.3)",{"type":48,"tag":57,"props":1208,"children":1209},{},[1210],{"type":54,"value":1211},"These controls verify backup encryption, recovery testing, and multi-region data localization.",{"type":48,"tag":57,"props":1213,"children":1214},{},[1215],{"type":48,"tag":66,"props":1216,"children":1217},{},[1218],{"type":54,"value":858},{"type":48,"tag":117,"props":1220,"children":1221},{},[1222,1242,1247],{"type":48,"tag":121,"props":1223,"children":1224},{},[1225,1227,1233,1234,1240],{"type":54,"value":1226},"5.1: Backups use ",{"type":48,"tag":286,"props":1228,"children":1230},{"className":1229},[],[1231],{"type":54,"value":1232},"kms",{"type":54,"value":817},{"type":48,"tag":286,"props":1235,"children":1237},{"className":1236},[],[1238],{"type":54,"value":1239},"encryption_passphrase",{"type":54,"value":1241},", or storage-layer encryption enforced (Manual)",{"type":48,"tag":121,"props":1243,"children":1244},{},[1245],{"type":54,"value":1246},"5.2: Recovery procedures tested quarterly with documented results (Manual)",{"type":48,"tag":121,"props":1248,"children":1249},{},[1250,1252,1258],{"type":54,"value":1251},"5.3: Multi-region tables use ",{"type":48,"tag":286,"props":1253,"children":1255},{"className":1254},[],[1256],{"type":54,"value":1257},"REGIONAL BY ROW",{"type":54,"value":1259}," or zone constraints for data residency (Manual)",{"type":48,"tag":714,"props":1261,"children":1263},{"id":1262},"step-6-cockroachdb-settings-controls-6165",[1264],{"type":54,"value":1265},"Step 6: CockroachDB Settings (Controls 6.1–6.5)",{"type":48,"tag":57,"props":1267,"children":1268},{},[1269],{"type":54,"value":1270},"These controls verify certificate security, setting redaction, audit logging, session timeouts, and OCSP.",{"type":48,"tag":57,"props":1272,"children":1273},{},[1274],{"type":48,"tag":66,"props":1275,"children":1276},{},[1277],{"type":54,"value":858},{"type":48,"tag":117,"props":1279,"children":1280},{},[1281,1294,1307,1334,1355],{"type":48,"tag":121,"props":1282,"children":1283},{},[1284,1286,1292],{"type":54,"value":1285},"6.1: Private key permissions ",{"type":48,"tag":286,"props":1287,"children":1289},{"className":1288},[],[1290],{"type":54,"value":1291},"0600",{"type":54,"value":1293},", certs valid 90+ days (Automated)",{"type":48,"tag":121,"props":1295,"children":1296},{},[1297,1299,1305],{"type":54,"value":1298},"6.2: Debug bundles use ",{"type":48,"tag":286,"props":1300,"children":1302},{"className":1301},[],[1303],{"type":54,"value":1304},"--redact",{"type":54,"value":1306},", no secrets in logs (Manual)",{"type":48,"tag":121,"props":1308,"children":1309},{},[1310,1312,1318,1320,1326,1327,1332],{"type":54,"value":1311},"6.3: ",{"type":48,"tag":286,"props":1313,"children":1315},{"className":1314},[],[1316],{"type":54,"value":1317},"sql.log.user_audit",{"type":54,"value":1319}," non-empty, ",{"type":48,"tag":286,"props":1321,"children":1323},{"className":1322},[],[1324],{"type":54,"value":1325},"sql.log.admin_audit.enabled",{"type":54,"value":1099},{"type":48,"tag":286,"props":1328,"children":1330},{"className":1329},[],[1331],{"type":54,"value":1105},{"type":54,"value":1333},", security channels configured (Manual)",{"type":48,"tag":121,"props":1335,"children":1336},{},[1337,1339,1345,1347,1353],{"type":54,"value":1338},"6.4: ",{"type":48,"tag":286,"props":1340,"children":1342},{"className":1341},[],[1343],{"type":54,"value":1344},"sql.defaults.idle_in_session_timeout",{"type":54,"value":1346}," set (e.g., ",{"type":48,"tag":286,"props":1348,"children":1350},{"className":1349},[],[1351],{"type":54,"value":1352},"15m",{"type":54,"value":1354},") (Manual)",{"type":48,"tag":121,"props":1356,"children":1357},{},[1358,1360,1366,1367,1373,1374,1380],{"type":54,"value":1359},"6.5: ",{"type":48,"tag":286,"props":1361,"children":1363},{"className":1362},[],[1364],{"type":54,"value":1365},"security.ocsp.mode",{"type":54,"value":1099},{"type":48,"tag":286,"props":1368,"children":1370},{"className":1369},[],[1371],{"type":54,"value":1372},"strict",{"type":54,"value":817},{"type":48,"tag":286,"props":1375,"children":1377},{"className":1376},[],[1378],{"type":54,"value":1379},"lax",{"type":54,"value":1381}," (Manual)",{"type":48,"tag":110,"props":1383,"children":1385},{"id":1384},"report-format",[1386],{"type":54,"value":1387},"Report Format",{"type":48,"tag":57,"props":1389,"children":1390},{},[1391,1393,1399],{"type":54,"value":1392},"Generate a markdown report following the structure in ",{"type":48,"tag":74,"props":1394,"children":1396},{"href":1395},"references\u002Fsample-report.md",[1397],{"type":54,"value":1398},"sample report",{"type":54,"value":1400},".",{"type":48,"tag":57,"props":1402,"children":1403},{},[1404],{"type":48,"tag":66,"props":1405,"children":1406},{},[1407],{"type":54,"value":1408},"Status markers:",{"type":48,"tag":117,"props":1410,"children":1411},{},[1412,1423,1434,1445],{"type":48,"tag":121,"props":1413,"children":1414},{},[1415,1421],{"type":48,"tag":286,"props":1416,"children":1418},{"className":1417},[],[1419],{"type":54,"value":1420},"[PASS]",{"type":54,"value":1422}," — Control is satisfied",{"type":48,"tag":121,"props":1424,"children":1425},{},[1426,1432],{"type":48,"tag":286,"props":1427,"children":1429},{"className":1428},[],[1430],{"type":54,"value":1431},"[FAIL]",{"type":54,"value":1433}," — Control is not satisfied, remediation required",{"type":48,"tag":121,"props":1435,"children":1436},{},[1437,1443],{"type":48,"tag":286,"props":1438,"children":1440},{"className":1439},[],[1441],{"type":54,"value":1442},"[MANUAL]",{"type":54,"value":1444}," — Requires human review; automated check cannot determine compliance",{"type":48,"tag":121,"props":1446,"children":1447},{},[1448,1454],{"type":48,"tag":286,"props":1449,"children":1451},{"className":1450},[],[1452],{"type":54,"value":1453},"[N\u002FA]",{"type":54,"value":1455}," — Control does not apply (e.g., EAR without Enterprise license)",{"type":48,"tag":110,"props":1457,"children":1459},{"id":1458},"relationship-to-other-security-skills",[1460],{"type":54,"value":1461},"Relationship to Other Security Skills",{"type":48,"tag":166,"props":1463,"children":1464},{},[1465,1481],{"type":48,"tag":170,"props":1466,"children":1467},{},[1468],{"type":48,"tag":174,"props":1469,"children":1470},{},[1471,1476],{"type":48,"tag":178,"props":1472,"children":1473},{},[1474],{"type":54,"value":1475},"CIS Section",{"type":48,"tag":178,"props":1477,"children":1478},{},[1479],{"type":54,"value":1480},"Related Remediation Skills",{"type":48,"tag":189,"props":1482,"children":1483},{},[1484,1508,1532,1563,1580],{"type":48,"tag":174,"props":1485,"children":1486},{},[1487,1492],{"type":48,"tag":196,"props":1488,"children":1489},{},[1490],{"type":54,"value":1491},"1 Installation",{"type":48,"tag":196,"props":1493,"children":1494},{},[1495,1501,1502],{"type":48,"tag":74,"props":1496,"children":1498},{"href":1497},"..\u002Fmanaging-tls-certificates\u002FSKILL.md",[1499],{"type":54,"value":1500},"managing-tls-certificates",{"type":54,"value":369},{"type":48,"tag":74,"props":1503,"children":1505},{"href":1504},"..\u002Fenabling-cmek-encryption\u002FSKILL.md",[1506],{"type":54,"value":1507},"enabling-cmek-encryption",{"type":48,"tag":174,"props":1509,"children":1510},{},[1511,1516],{"type":48,"tag":196,"props":1512,"children":1513},{},[1514],{"type":54,"value":1515},"3 Logging",{"type":48,"tag":196,"props":1517,"children":1518},{},[1519,1525,1526],{"type":48,"tag":74,"props":1520,"children":1522},{"href":1521},"..\u002Fconfiguring-audit-logging\u002FSKILL.md",[1523],{"type":54,"value":1524},"configuring-audit-logging",{"type":54,"value":369},{"type":48,"tag":74,"props":1527,"children":1529},{"href":1528},"..\u002Fconfiguring-log-export\u002FSKILL.md",[1530],{"type":54,"value":1531},"configuring-log-export",{"type":48,"tag":174,"props":1533,"children":1534},{},[1535,1540],{"type":48,"tag":196,"props":1536,"children":1537},{},[1538],{"type":54,"value":1539},"4 User Access",{"type":48,"tag":196,"props":1541,"children":1542},{},[1543,1549,1550,1556,1557],{"type":48,"tag":74,"props":1544,"children":1546},{"href":1545},"..\u002Fhardening-user-privileges\u002FSKILL.md",[1547],{"type":54,"value":1548},"hardening-user-privileges",{"type":54,"value":369},{"type":48,"tag":74,"props":1551,"children":1553},{"href":1552},"..\u002Fenforcing-password-policies\u002FSKILL.md",[1554],{"type":54,"value":1555},"enforcing-password-policies",{"type":54,"value":369},{"type":48,"tag":74,"props":1558,"children":1560},{"href":1559},"..\u002Fconfiguring-sso-and-scim\u002FSKILL.md",[1561],{"type":54,"value":1562},"configuring-sso-and-scim",{"type":48,"tag":174,"props":1564,"children":1565},{},[1566,1571],{"type":48,"tag":196,"props":1567,"children":1568},{},[1569],{"type":54,"value":1570},"5 Data Protection",{"type":48,"tag":196,"props":1572,"children":1573},{},[1574],{"type":48,"tag":74,"props":1575,"children":1577},{"href":1576},"..\u002Fpreparing-compliance-documentation\u002FSKILL.md",[1578],{"type":54,"value":1579},"preparing-compliance-documentation",{"type":48,"tag":174,"props":1581,"children":1582},{},[1583,1588],{"type":48,"tag":196,"props":1584,"children":1585},{},[1586],{"type":54,"value":1587},"6 Settings",{"type":48,"tag":196,"props":1589,"children":1590},{},[1591,1595,1596],{"type":48,"tag":74,"props":1592,"children":1593},{"href":1497},[1594],{"type":54,"value":1500},{"type":54,"value":369},{"type":48,"tag":74,"props":1597,"children":1598},{"href":1521},[1599],{"type":54,"value":1524},{"type":48,"tag":57,"props":1601,"children":1602},{},[1603,1605,1609],{"type":54,"value":1604},"For a broader security posture assessment (covering Cloud and self-hosted), use ",{"type":48,"tag":74,"props":1606,"children":1607},{"href":76},[1608],{"type":54,"value":79},{"type":54,"value":1400},{"type":48,"tag":110,"props":1611,"children":1613},{"id":1612},"safety-considerations",[1614],{"type":54,"value":1615},"Safety Considerations",{"type":48,"tag":117,"props":1617,"children":1618},{},[1619,1629,1697,1707,1731,1741],{"type":48,"tag":121,"props":1620,"children":1621},{},[1622,1627],{"type":48,"tag":66,"props":1623,"children":1624},{},[1625],{"type":54,"value":1626},"All operations are read-only.",{"type":54,"value":1628}," No cluster settings, OS configuration, or files are modified.",{"type":48,"tag":121,"props":1630,"children":1631},{},[1632,1637,1639,1644,1645,1650,1651,1656,1657,1662,1663,1669,1670,1676,1677,1682,1683,1689,1690,1696],{"type":48,"tag":66,"props":1633,"children":1634},{},[1635],{"type":54,"value":1636},"Shell commands use read-only tools:",{"type":54,"value":1638}," ",{"type":48,"tag":286,"props":1640,"children":1642},{"className":1641},[],[1643],{"type":54,"value":367},{"type":54,"value":369},{"type":48,"tag":286,"props":1646,"children":1648},{"className":1647},[],[1649],{"type":54,"value":375},{"type":54,"value":369},{"type":48,"tag":286,"props":1652,"children":1654},{"className":1653},[],[1655],{"type":54,"value":382},{"type":54,"value":369},{"type":48,"tag":286,"props":1658,"children":1660},{"className":1659},[],[1661],{"type":54,"value":389},{"type":54,"value":369},{"type":48,"tag":286,"props":1664,"children":1666},{"className":1665},[],[1667],{"type":54,"value":1668},"systemctl is-enabled\u002Fis-active",{"type":54,"value":369},{"type":48,"tag":286,"props":1671,"children":1673},{"className":1672},[],[1674],{"type":54,"value":1675},"swapon --show",{"type":54,"value":369},{"type":48,"tag":286,"props":1678,"children":1680},{"className":1679},[],[1681],{"type":54,"value":403},{"type":54,"value":369},{"type":48,"tag":286,"props":1684,"children":1686},{"className":1685},[],[1687],{"type":54,"value":1688},"openssl x509",{"type":54,"value":369},{"type":48,"tag":286,"props":1691,"children":1693},{"className":1692},[],[1694],{"type":54,"value":1695},"openssl verify",{"type":54,"value":1400},{"type":48,"tag":121,"props":1698,"children":1699},{},[1700,1705],{"type":48,"tag":66,"props":1701,"children":1702},{},[1703],{"type":54,"value":1704},"SQL queries use SHOW and SELECT only.",{"type":54,"value":1706}," No DDL or DML statements.",{"type":48,"tag":121,"props":1708,"children":1709},{},[1710,1715,1717,1722,1724,1729],{"type":48,"tag":66,"props":1711,"children":1712},{},[1713],{"type":54,"value":1714},"One exception (4.2):",{"type":54,"value":1716}," The full audit procedure for password hash inspection requires ",{"type":48,"tag":286,"props":1718,"children":1720},{"className":1719},[],[1721],{"type":54,"value":1144},{"type":54,"value":1723}," — this is a read-only break-glass operation that must be reset immediately after (",{"type":48,"tag":286,"props":1725,"children":1727},{"className":1726},[],[1728],{"type":54,"value":1152},{"type":54,"value":1730},"). Only authorized operators should run this step.",{"type":48,"tag":121,"props":1732,"children":1733},{},[1734,1739],{"type":48,"tag":66,"props":1735,"children":1736},{},[1737],{"type":54,"value":1738},"No secrets are logged.",{"type":54,"value":1740}," Certificate private keys and passwords are not included in report output.",{"type":48,"tag":121,"props":1742,"children":1743},{},[1744,1749],{"type":48,"tag":66,"props":1745,"children":1746},{},[1747],{"type":54,"value":1748},"Privilege check:",{"type":54,"value":1750}," Some SQL queries require admin or VIEWACTIVITY privilege. The report notes any permission gaps.",{"type":48,"tag":110,"props":1752,"children":1754},{"id":1753},"references",[1755],{"type":54,"value":1756},"References",{"type":48,"tag":57,"props":1758,"children":1759},{},[1760],{"type":48,"tag":66,"props":1761,"children":1762},{},[1763],{"type":54,"value":1764},"Skill references:",{"type":48,"tag":117,"props":1766,"children":1767},{},[1768,1777,1788],{"type":48,"tag":121,"props":1769,"children":1770},{},[1771,1775],{"type":48,"tag":74,"props":1772,"children":1773},{"href":701},[1774],{"type":54,"value":704},{"type":54,"value":1776}," — All 30 controls with quick scan commands and full audit procedures",{"type":48,"tag":121,"props":1778,"children":1779},{},[1780,1786],{"type":48,"tag":74,"props":1781,"children":1783},{"href":1782},"references\u002Fsql-queries.md",[1784],{"type":54,"value":1785},"SQL queries for CIS audit",{"type":54,"value":1787}," — All SQL queries used in the assessment",{"type":48,"tag":121,"props":1789,"children":1790},{},[1791,1796],{"type":48,"tag":74,"props":1792,"children":1793},{"href":1395},[1794],{"type":54,"value":1795},"Sample audit report",{"type":54,"value":1797}," — Example report with findings",{"type":48,"tag":57,"props":1799,"children":1800},{},[1801],{"type":48,"tag":66,"props":1802,"children":1803},{},[1804],{"type":54,"value":89},{"type":48,"tag":117,"props":1806,"children":1807},{},[1808],{"type":48,"tag":121,"props":1809,"children":1810},{},[1811],{"type":48,"tag":74,"props":1812,"children":1814},{"href":94,"rel":1813},[96],[1815],{"type":54,"value":1816},"CIS CockroachDB Benchmark (official repo)",{"type":48,"tag":57,"props":1818,"children":1819},{},[1820],{"type":48,"tag":66,"props":1821,"children":1822},{},[1823],{"type":54,"value":1824},"Related skills:",{"type":48,"tag":117,"props":1826,"children":1827},{},[1828,1837,1846,1855,1864,1873,1882],{"type":48,"tag":121,"props":1829,"children":1830},{},[1831,1835],{"type":48,"tag":74,"props":1832,"children":1833},{"href":76},[1834],{"type":54,"value":79},{"type":54,"value":1836}," — Broader security posture assessment",{"type":48,"tag":121,"props":1838,"children":1839},{},[1840,1844],{"type":48,"tag":74,"props":1841,"children":1842},{"href":1521},[1843],{"type":54,"value":1524},{"type":54,"value":1845}," — SQL audit logging setup",{"type":48,"tag":121,"props":1847,"children":1848},{},[1849,1853],{"type":48,"tag":74,"props":1850,"children":1851},{"href":1545},[1852],{"type":54,"value":1548},{"type":54,"value":1854}," — RBAC tightening",{"type":48,"tag":121,"props":1856,"children":1857},{},[1858,1862],{"type":48,"tag":74,"props":1859,"children":1860},{"href":1552},[1861],{"type":54,"value":1555},{"type":54,"value":1863}," — Password policy enforcement",{"type":48,"tag":121,"props":1865,"children":1866},{},[1867,1871],{"type":48,"tag":74,"props":1868,"children":1869},{"href":1497},[1870],{"type":54,"value":1500},{"type":54,"value":1872}," — TLS certificate management",{"type":48,"tag":121,"props":1874,"children":1875},{},[1876,1880],{"type":48,"tag":74,"props":1877,"children":1878},{"href":1504},[1879],{"type":54,"value":1507},{"type":54,"value":1881}," — Encryption at rest",{"type":48,"tag":121,"props":1883,"children":1884},{},[1885,1889],{"type":48,"tag":74,"props":1886,"children":1887},{"href":1559},[1888],{"type":54,"value":1562},{"type":54,"value":1890}," — SSO and SCIM provisioning",{"type":48,"tag":57,"props":1892,"children":1893},{},[1894],{"type":48,"tag":66,"props":1895,"children":1896},{},[1897],{"type":54,"value":1898},"Official CockroachDB documentation:",{"type":48,"tag":117,"props":1900,"children":1901},{},[1902,1912,1922,1932],{"type":48,"tag":121,"props":1903,"children":1904},{},[1905],{"type":48,"tag":74,"props":1906,"children":1909},{"href":1907,"rel":1908},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Fsecurity-overview.html",[96],[1910],{"type":54,"value":1911},"Security Overview",{"type":48,"tag":121,"props":1913,"children":1914},{},[1915],{"type":48,"tag":74,"props":1916,"children":1919},{"href":1917,"rel":1918},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Frecommended-production-settings.html",[96],[1920],{"type":54,"value":1921},"Recommended Production Settings",{"type":48,"tag":121,"props":1923,"children":1924},{},[1925],{"type":48,"tag":74,"props":1926,"children":1929},{"href":1927,"rel":1928},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Freleases\u002F",[96],[1930],{"type":54,"value":1931},"Releases",{"type":48,"tag":121,"props":1933,"children":1934},{},[1935],{"type":48,"tag":74,"props":1936,"children":1939},{"href":1937,"rel":1938},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fadvisories\u002F",[96],[1940],{"type":54,"value":1941},"Security Advisories",{"items":1943,"total":2096},[1944,1963,1977,1992,2003,2013,2026,2038,2053,2060,2070,2083],{"slug":1945,"name":1945,"fn":1946,"description":1947,"org":1948,"tags":1949,"stars":1960,"repoUrl":1961,"updatedAt":1962},"collecting-cockroachdb-operator-escalation-packet","collect CockroachDB operator escalation packets","Collects a complete CockroachDB Operator escalation packet for TSC\u002FTSE or operator-team handoff, including Helm state, Kubernetes resources, logs, operation-specific evidence, pprof goroutine dumps, metrics, and a customer action timeline. Use when general diagnosis cannot resolve an operator-managed CockroachDB Helm issue or before restarting a stuck operator.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1950,1951,1954,1957],{"name":23,"slug":24,"type":15},{"name":1952,"slug":1953,"type":15},"Incident Response","incident-response",{"name":1955,"slug":1956,"type":15},"Kubernetes","kubernetes",{"name":1958,"slug":1959,"type":15},"Monitoring","monitoring",105,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fhelm-charts","2026-07-12T07:57:25.288146",{"slug":1964,"name":1964,"fn":1965,"description":1966,"org":1967,"tags":1968,"stars":1960,"repoUrl":1961,"updatedAt":1976},"configuring-cockroachdb-helm-tls","configure TLS for CockroachDB Helm charts","Selects and validates TLS settings for CockroachDB Helm chart deployments, including self-signer, cert-manager, and external certificate modes. Use when a customer needs secure CockroachDB Helm values, certificate secret mapping, cert-manager integration, or TLS install troubleshooting before deploying the chart.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1969,1972,1975],{"name":1970,"slug":1971,"type":15},"Deployment","deployment",{"name":1973,"slug":1974,"type":15},"Encryption","encryption",{"name":13,"slug":14,"type":15},"2026-07-12T07:56:37.675396",{"slug":1978,"name":1978,"fn":1979,"description":1980,"org":1981,"tags":1982,"stars":1960,"repoUrl":1961,"updatedAt":1991},"debugging-cockroachdb-operator-migrations","debug CockroachDB Operator migration scenarios","Debugs CockroachDB Operator migration scenarios, including Helm StatefulSet to v1beta1 CrdbNode migration and public operator v1alpha1 to v1beta1 migration. Use when migration labels, migration phases, source StatefulSet ownership, converted CRDs, PVC ownership, or post-migration reconciliation are unclear or stuck.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1983,1984,1987,1988],{"name":23,"slug":24,"type":15},{"name":1985,"slug":1986,"type":15},"Debugging","debugging",{"name":1955,"slug":1956,"type":15},{"name":1989,"slug":1990,"type":15},"Migration","migration","2026-07-12T07:56:48.360871",{"slug":1993,"name":1993,"fn":1994,"description":1995,"org":1996,"tags":1997,"stars":1960,"repoUrl":1961,"updatedAt":2002},"diagnosing-cockroachdb-helm-deployments","diagnose CockroachDB Helm chart deployments","Diagnoses failed or unhealthy CockroachDB Helm chart deployments by checking Helm release state, operator health, CrdbCluster and CrdbNode status, pod readiness, RBAC, webhooks, TLS, upgrades, scaling, PVCs, DNS, and multi-region assumptions. Use when Helm install or upgrade fails, pods are not Ready, or the operator is not reconciling.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1998,1999,2000,2001],{"name":23,"slug":24,"type":15},{"name":1985,"slug":1986,"type":15},{"name":1970,"slug":1971,"type":15},{"name":1955,"slug":1956,"type":15},"2026-07-12T07:57:24.018818",{"slug":2004,"name":2004,"fn":2005,"description":2006,"org":2007,"tags":2008,"stars":1960,"repoUrl":1961,"updatedAt":2012},"installing-cockroachdb-with-helm","install CockroachDB using Helm","Guides customer-facing installation of CockroachDB on Kubernetes using the CockroachDB split Helm charts and operator-managed v1beta1 resources. Use when installing CockroachDB with Helm, choosing between published and local split charts, verifying a new install, or helping an agent complete first-time Kubernetes onboarding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2009,2010,2011],{"name":23,"slug":24,"type":15},{"name":1970,"slug":1971,"type":15},{"name":1955,"slug":1956,"type":15},"2026-07-12T07:56:45.777567",{"slug":2014,"name":2014,"fn":2015,"description":2016,"org":2017,"tags":2018,"stars":1960,"repoUrl":1961,"updatedAt":2025},"validating-cockroachdb-helm-multiregion","validate CockroachDB multi-region Helm deployments","Validates CockroachDB Helm chart values and Kubernetes prerequisites for operator-managed multi-region deployments. Use before adding a region, deploying CockroachDB across multiple Kubernetes clusters, checking region DNS domains, or confirming that all regions share certificate and networking assumptions.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2019,2020,2021,2022],{"name":23,"slug":24,"type":15},{"name":1970,"slug":1971,"type":15},{"name":1955,"slug":1956,"type":15},{"name":2023,"slug":2024,"type":15},"Operations","operations","2026-07-12T07:56:47.082609",{"slug":2027,"name":2027,"fn":2028,"description":2029,"org":2030,"tags":2031,"stars":25,"repoUrl":26,"updatedAt":2037},"analyzing-range-distribution","analyze CockroachDB range distribution and health","Analyzes CockroachDB range distribution across tables and indexes using SHOW RANGES to identify range count, size patterns, leaseholder placement, and replication health. Use when investigating hotspots, uneven data distribution, range fragmentation, or validating zone configuration effects without DB Console access.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2032,2033,2034],{"name":23,"slug":24,"type":15},{"name":1958,"slug":1959,"type":15},{"name":2035,"slug":2036,"type":15},"Performance","performance","2026-07-12T07:57:18.753533",{"slug":2039,"name":2039,"fn":2040,"description":2041,"org":2042,"tags":2043,"stars":25,"repoUrl":26,"updatedAt":2052},"analyzing-schema-change-storage-risk","analyze schema change storage requirements","Estimates storage requirements for CockroachDB online schema change backfills using SHOW RANGES WITH DETAILS, KEYS, INDEXES. Use before CREATE INDEX, ADD COLUMN with INDEX\u002FUNIQUE, ALTER PRIMARY KEY, CREATE MATERIALIZED VIEW, CREATE TABLE AS, REFRESH, or SET LOCALITY on tables with large per-index footprints, to avoid mid-backfill disk exhaustion.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2044,2047,2048,2049],{"name":2045,"slug":2046,"type":15},"Data Modeling","data-modeling",{"name":23,"slug":24,"type":15},{"name":2035,"slug":2036,"type":15},{"name":2050,"slug":2051,"type":15},"SQL","sql","2026-07-12T07:57:22.763788",{"slug":4,"name":4,"fn":5,"description":6,"org":2054,"tags":2055,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2056,2057,2058,2059],{"name":20,"slug":21,"type":15},{"name":17,"slug":18,"type":15},{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},{"slug":79,"name":79,"fn":2061,"description":2062,"org":2063,"tags":2064,"stars":25,"repoUrl":26,"updatedAt":2069},"audit CockroachDB cluster security posture","Audits the security posture of a CockroachDB cluster (Cloud or self-hosted) across network, authentication, authorization, encryption, audit logging, and backup dimensions. Use when assessing cluster security readiness, preparing for compliance reviews, or investigating security configuration gaps.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2065,2066,2067,2068],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":2023,"slug":2024,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:57:01.506735",{"slug":2071,"name":2071,"fn":2072,"description":2073,"org":2074,"tags":2075,"stars":25,"repoUrl":26,"updatedAt":2082},"auditing-table-statistics","audit optimizer table statistics","Audits optimizer table statistics for staleness, missing coverage, and data quality issues using SHOW STATISTICS. Use when diagnosing poor query performance, unexpected plan changes, or after bulk data changes to identify stale statistics requiring refresh via CREATE STATISTICS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2076,2077,2080,2081],{"name":20,"slug":21,"type":15},{"name":2078,"slug":2079,"type":15},"Data Analysis","data-analysis",{"name":23,"slug":24,"type":15},{"name":2035,"slug":2036,"type":15},"2026-07-12T07:57:16.190081",{"slug":2084,"name":2084,"fn":2085,"description":2086,"org":2087,"tags":2088,"stars":25,"repoUrl":26,"updatedAt":2095},"benchmarking-transaction-patterns","benchmark CockroachDB transaction patterns","Guides benchmarking and comparing explicit multi-statement transactions versus single-statement CTE transactions in CockroachDB, with fair test methodology, contention analysis, and performance interpretation. Use when comparing transaction formulations, benchmarking CockroachDB workloads under contention, investigating retry pressure, or deciding whether to rewrite multi-step application flows into single SQL statements.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2089,2090,2093,2094],{"name":23,"slug":24,"type":15},{"name":2091,"slug":2092,"type":15},"Engineering","engineering",{"name":2035,"slug":2036,"type":15},{"name":2050,"slug":2051,"type":15},"2026-07-12T07:57:26.543278",40,{"items":2098,"total":2150},[2099,2105,2112,2119,2126,2133,2140],{"slug":2027,"name":2027,"fn":2028,"description":2029,"org":2100,"tags":2101,"stars":25,"repoUrl":26,"updatedAt":2037},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2102,2103,2104],{"name":23,"slug":24,"type":15},{"name":1958,"slug":1959,"type":15},{"name":2035,"slug":2036,"type":15},{"slug":2039,"name":2039,"fn":2040,"description":2041,"org":2106,"tags":2107,"stars":25,"repoUrl":26,"updatedAt":2052},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2108,2109,2110,2111],{"name":2045,"slug":2046,"type":15},{"name":23,"slug":24,"type":15},{"name":2035,"slug":2036,"type":15},{"name":2050,"slug":2051,"type":15},{"slug":4,"name":4,"fn":5,"description":6,"org":2113,"tags":2114,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2115,2116,2117,2118],{"name":20,"slug":21,"type":15},{"name":17,"slug":18,"type":15},{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},{"slug":79,"name":79,"fn":2061,"description":2062,"org":2120,"tags":2121,"stars":25,"repoUrl":26,"updatedAt":2069},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2122,2123,2124,2125],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":2023,"slug":2024,"type":15},{"name":13,"slug":14,"type":15},{"slug":2071,"name":2071,"fn":2072,"description":2073,"org":2127,"tags":2128,"stars":25,"repoUrl":26,"updatedAt":2082},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2129,2130,2131,2132],{"name":20,"slug":21,"type":15},{"name":2078,"slug":2079,"type":15},{"name":23,"slug":24,"type":15},{"name":2035,"slug":2036,"type":15},{"slug":2084,"name":2084,"fn":2085,"description":2086,"org":2134,"tags":2135,"stars":25,"repoUrl":26,"updatedAt":2095},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2136,2137,2138,2139],{"name":23,"slug":24,"type":15},{"name":2091,"slug":2092,"type":15},{"name":2035,"slug":2036,"type":15},{"name":2050,"slug":2051,"type":15},{"slug":2141,"name":2141,"fn":2142,"description":2143,"org":2144,"tags":2145,"stars":25,"repoUrl":26,"updatedAt":2149},"cockroachdb-sql","write and optimize CockroachDB SQL","Use when writing, generating, or optimizing SQL for CockroachDB, designing CockroachDB schemas, or when the user asks about CockroachDB-specific SQL patterns, type mappings, and distributed database best practices. Also use when encountering CockroachDB anti-patterns like missing primary keys, sequential ID hotspots, or incorrect type usage.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2146,2147,2148],{"name":23,"slug":24,"type":15},{"name":2035,"slug":2036,"type":15},{"name":2050,"slug":2051,"type":15},"2026-07-25T05:31:22.562808",34]