>_SecOpsLog_
All courses

InSpec

InSpec turns a compliance check into executable code you run against a host, container, or cloud API. This course covers the control language, profiles and inputs, inheritance, remote targets, CIS/DISA baselines, waivers, and using a scan as a CI gate. A green report is a snapshot of that moment, not continuous compliance, and a waiver without an expiry date is just a silenced control.

Intermediate3 sections · 12 lessons · ~5h total · 14-question self-test
Start course
01

InSpec fundamentals

4 lessons
01What InSpec is: compliance as codeExecutable, human-readable controls.12 min02Install & first scaninspec exec against a target.10 min03The control languagedescribe, it, expect, resources.14 min04Running & reading resultsPassed, failed, skipped.10 min
02

Resources, profiles & targets

4 lessons
01Resources & matchersThe building blocks of controls.14 min02Profiles, inputs & metadataPackage and parameterize controls.12 min03Inheritance & overlaysReuse and tailor baselines.12 min04Remote & cloud targetsSSH, WinRM, and cloud APIs.12 min
03

Baselines, reporting & delivery

4 lessons
01CIS/DISA baselines & waiversPrebuilt controls; documented exceptions.14 min02Reporting & attestationsEvidence auditors accept.12 min03InSpec in CI/CD & pipelinesGate images and infra on compliance.12 min04The compliance-scanning landscapeOpenSCAP, OSQuery, Terratest.10 min

Progress is saved in this browser only — no account required.

Final exam
Test yourself on everything
14 questions drawn from all 3 sections — every answer explained as you pick.
Start final exam