sysctl:
  whitelist: # or blacklist
    fstab_tmp_partition:  # unique ID
      data:
        CentOS Linux-6:  # osfinger grain
          - 'net.ipv4.ip_forward':  # sysctl query
              tag: 'CIS-1.1.1'  # audit tag
              match_output: '0'  # string to check for in output of sysctl query
        '*':  # wildcard, will be run if no direct osfinger match
          - 'net.ipv4.ip_forward':
              tag: 'CIS-1.1.23423'
              pattern: '0'
      # The rest of these attributes are optional, and currently not used
      description: |
          Setting the flag to 0 ensures that a server with multiple interfaces
          (for example, a hard proxy), will never be able to forward packets,
          and therefore, never serve as a router
      alert: email
      trigger: state

sysctl:
  whitelist: # or blacklist
    net.ipv4.ip_forward:  # unique ID
      data:
        CentOS Linux-6:  # osfinger grain
          - 'net.ipv4.ip_forward':  # sysctl query
              tag: 'CIS-1.1.1'  # audit tag
              match_output: '0'  # string to check for in output of sysctl query
        '*':  # wildcard, will be run if no direct osfinger match
          - 'net.ipv4.ip_forward':
              tag: 'CIS-1.1.23423'
              pattern: '0'
      # The rest of these attributes are optional, and currently not used
      description: |
          Setting the flag to 0 ensures that a server with multiple interfaces
          (for example, a hard proxy), will never be able to forward packets,
          and therefore, never serve as a router
      alert: email
      trigger: state

Fix ID for sample sysctl
Fix ID for sample sysctl