mitre / inspec_tools

A command-line and ruby API of utilities, converters and tools for creating, converting and processing security baseline formats, results and data
https://inspec-tools.mitre.org/
Other
91 stars 30 forks source link

Add stigid and title fields and Rule_ver to inspec2ckl #233

Closed ejaronne closed 3 years ago

ejaronne commented 3 years ago

Add stigid and title SID_NAMEs to .ckl output:

Use the value of profiles:name

For example, for a typical InSpec run, should look like this:

    <SI_DATA>
        <SID_NAME>stigid</SID_NAME>
        <SID_DATA>microsoft-windows-10-stig-baseline</SID_DATA>
    </SI_DATA>
    <SI_DATA>
        <SID_NAME>title</SID_NAME>
        <SID_DATA>microsoft-windows-10-stig-baseline</SID_DATA>
    </SI_DATA>

From a Nessus compliance scan converted to HDF via Heimdall_tools, should end up like:

    <SI_DATA>
        <SID_NAME>stigid</SID_NAME>
        <SID_DATA>Nessus Policy Compliance Auditing</SID_DATA>
    </SI_DATA>
    <SI_DATA>
        <SID_NAME>title</SID_NAME>
        <SID_DATA>Nessus Policy Compliance Auditing</SID_DATA>
    </SI_DATA>

(STIG Viewer uses the title to identify the "STIG" name, whereas eMASS uses the stigid to identify the "Benchmark" name.

Also, map HDF tag:stig_id to the value of Rule_Ver, for example:

            <STIG_DATA>
                <VULN_ATTRIBUTE>Rule_Ver</VULN_ATTRIBUTE>
                <ATTRIBUTE_DATA>WN10-00-000005</ATTRIBUTE_DATA>
            </STIG_DATA>
aaronlippold commented 3 years ago

also, double check that we are adding the rule_id given we now know that is the primary key for emass - basically the same thing we learned with the xccdf2inspec rule id thing

aaronlippold commented 3 years ago

from the email we recieved: "Additionally, we did confirm that asset matching criteria is checking against Host Name, MAC Address, and IP Address." so by default we should encourge users to provide this info when we create a ckl.

Bialogs commented 3 years ago

Workaround for the time being is to provide the stigid metadata