ansible-lockdown / RHEL8-CIS-Audit

Audit configurations for RHEL8 CIS - utilising goss
MIT License
31 stars 25 forks source link

Any tool to read the output JSON file? #70

Open strus38 opened 1 month ago

strus38 commented 1 month ago

Question Very new to this project, I executed the CIS-RHEL8 audit, and the result is a JSON file, is there a tool to view it in another format (easier to see SUCCESS/FAILURE)?

Environment (please complete the following information):

uk-bolly commented 1 month ago

hi @strus38

Thank you for raising the question. If you are using the script manually you can pass it the option for the documentation output. e.g. run_audit -f documentation

If you are using it via the playbook to can set the variable audit_format to be documentation.

This will produce a much more human readable output with all failures in a section of the file. For quick results I use awk to capture the titles and rules that show as failing awk 'f;/Failures/{f=1}' {{ insert_filename_here}} | grep -w "Title" | cut -d: -f2 | sort

There is currently in works a method to present/sort/report on this which we hope we are able to show soon.

I hope that helps.

Many thanks

uk-bolly

strus38 commented 1 month ago

Thanks!! However, not sure which json file you get since mine does not have 'Title' but 'title', neither 'Failures', I am using the 3.0.0_august' branch. So I did:

cat /opt/audit_xxx-CIS-RHEL8_1725515602.json | jq '.results[] | select(.successful==false) .title' | sort -u
uk-bolly commented 1 month ago

hi @strus38

Im not using the json file as mentioned i changed the format to documentation for an easier reading file. The PR should be moved to the correct branch in the next day or so.

Let me know if this is still not working.

many thanks

uk-bolly

uk-bolly commented 1 month ago

Hi @strus38

The PR was merged last week so i am hoping with the details above this has helped with this issue? There is also another issue we maybe extending the product to provide more out put to better show where an issue failed.

Please let us know if this resolves your issue?

thanks

uk-bolly