Quickstart

This quickstart takes you from zero to your first security report in a few minutes. You'll install cnspec, scan the machine you're working on, learn how to read the results, and explore your system interactively with MQL.

You don't need a Mondoo Platform account to follow along. Everything here runs entirely from the command line.

Step 1: Install cnspec

Install cnspec with the automated script for your operating system.

Linux and macOS:

bash -c "$(curl -sSL https://install.mondoo.com/sh)"

Windows (PowerShell):

Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://install.mondoo.com/ps1/cnspec')); Install-Mondoo -Product cnspec;

Confirm the install:

cnspec version

Step 2: Run your first scan

Point cnspec at the local machine and let it pick the right policy automatically:

cnspec scan local

cnspec detects the operating system, downloads the matching security policy, and evaluates your system against every check in that policy. The first scan takes a moment while cnspec installs the provider it needs.

Step 3: Read the results

When the scan finishes, cnspec prints a report. Three things tell you what happened:

1. Each check shows a pass or fail result. A check verifies one specific requirement, such as whether SSH root login is disabled.

   ✓ Pass:  Ensure SSH root login is disabled
   ✕ Fail:  Ensure IP forwarding is disabled
   ✓ Pass:  Ensure no user has an empty password

2. Failed checks include remediation guidance. cnspec explains why the check matters and how to fix it.

3. An overall score from 0 to 100 summarizes the asset's posture. A score of 100 means every check passed.

Want more or less detail? Add the -o flag to change the output format. For example, -o full prints every check with its description and remediation, and -o summary prints just the scores:

cnspec scan local -o full

Step 4: Explore your system with MQL

A scan answers "Is my system secure?" The cnspec shell answers "What is true about my system right now?" It opens an interactive session where you query any asset using MQL (Mondoo Query Language).

Open a shell against the local machine:

cnspec shell local

Inside the shell, ask questions about the system. List every user and whether the account is enabled:

cnspec> users { name uid enabled }

Check a specific setting, such as whether SSH root login is disabled:

cnspec> sshd.config.params["PermitRootLogin"] == "no"
[ok] value: "no"

Type help to list the resources you can query, or exit to leave the shell. The same MQL you prototype here becomes the checks in a policy.

Step 5: Scan something real

local is just the start. cnspec scans cloud accounts, Kubernetes clusters, SaaS platforms, network devices, and more, without installing an agent on the target. Pick what you want to secure:

For the complete list of everything cnspec can scan, see Supported Scan Targets.

Where to go next

Now that you've run a scan, here's how to go deeper: