public/Infrastrucutre as Code/Ansible/roles/cis_hardening/kernel_hardening/defaults/main.yml

---
# Kernel defaults (override per host if needed)
modprobe_blacklist_file: /etc/modprobe.d/cis_blacklist.conf

# Additional kernel modules to disable
blacklist_modules:
  - tipc