Cingulara
commented
2 years ago The tenable XCCDF xml file looks something like this below at the top of the file. The https://github.com/Cingulara/openrmf-api-read/blob/develop/src/Classes/SCAPScanResultLoader.cs file looks for the xccdd: for Nessus and then just pdf: for DISA SCAP. OpenSCAP does not add XML tags at all. But they all are SCAP "compliant". So the file there looks for that.
<xccdf:TestResult id="xccdf_mil.disa.stig_testresult_Windows_2012_MS_STIG" test-system="cpe:/a:tenable:nessus"
start-time="2019-12-03T15:34:19.000-00:00" end-time="2019-12-03T15:36:54.000-00:00"
xmlns:xccdf="http://checklists.nist.gov/xccdf/1.2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2 http://scap.nist.gov/schema/xccdf/1.2/xccdf_1.2.xsd" version="1.0">
<xccdf:benchmark href="U_MS_Windows_2012_and_2012_R2_MS_V2R17_STIG_SCAP_1-2_Benchmark.xml"
id="xccdf_mil.disa.stig_benchmark_Windows_2012_MS_STIG"/>If your XCCDF xml file looks different than the above it may not match correctly possibly. The results look like this below with the "pass" or "fail" as well to show Not a Finding or Open. By default all are the Not Reviewed:
<xccdf:rule-result idref="xccdf_mil.disa.stig_rule_SV-53010r3_rule" version="WN12-GE-000019" weight="10.0" severity="medium" role="full" >
<xccdf:result>pass</xccdf:result>
<xccdf:ident system="http://iase.disa.mil/cci">CCI-000366</xccdf:ident>
<xccdf:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" negate="false">
<xccdf:check-content-ref href="#oval1" name="oval:mil.disa.fso.windows:def:5160"/>
</xccdf:check>
</xccdf:rule-result>
<xccdf:rule-result idref="xccdf_mil.disa.stig_rule_SV-52894r1_rule" version="WN12-SO-000068" weight="10.0" severity="medium" role="full" >
<xccdf:result>pass</xccdf:result>
<xccdf:ident system="http://cce.mitre.org">CCE-25245-2</xccdf:ident>
<xccdf:ident system="http://iase.disa.mil/cci">CCI-000366</xccdf:ident>
<xccdf:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" negate="false">
<xccdf:check-content-ref href="#oval1" name="oval:mil.disa.fso.windows:def:4594"/>
</xccdf:check>
</xccdf:rule-result>(An example is here as a TXT file, just rename to .XML only. )
1-2_windows-4-xccdf-res-cleaned.xml.txt
So we need to see why yours are not parsing right. There are a few questions that pop to the top of my mind below that may help:
- Can you verify you have a similar setup in your XML to the above?
- Can you tell us what Nessus version you are using so we can match against it locally here? We have Nessus Professional v10.1.1 locally to test patch vulnerability scans, Audit Compliance Scans and SCAP.
- And verify you are using the DISA benchmarks when you run these?
- When you run the SCAP auditing scan, what version of SCAP are you using?
I do not want to ask on sharing sensitive company information. However, if there is a sanitized version you can email as a possibility to test locally and trap in code we can go that route as well.
dj4n60
Describe the bug I am trying to upload the nessus scap result. But all the checklist that I upload is labeled as "Not Reviewed" Furthermore nessus on it on dashboard show the results.
To Reproduce Steps to reproduce the behavior:
Expected behavior Having the Same Result as nessus
Screenshots
Desktop (please complete the following information):