systemd-analyze security {service} gives you a nice print out of what flags are able to be set. Note it doesn’t actually check what flags are compatible. I use it as a starting point of what to try.