search

mitre / saf

The MITRE Security Automation Framework (SAF) Command Line Interface (CLI) brings together applications, techniques, libraries, and tools developed by MITRE and the security community to streamline security automation for systems and DevOps pipelines
https://saf-cli.mitre.org
Other
133 stars 37 forks source link

feat: inspec2ckl & inspec2xccdf #1147

Closed HerbBoy closed 1 year ago

HerbBoy commented 1 year ago

Hi,

A feature I think that would be quite valuable is to re-add what was apart of https://github.com/mitre/inspec_tools which was seemingly dropped when merged into saf.

If more information is necessary id be happy to expand. But this would be a definite value add to many.

aaronlippold commented 1 year ago

This capability was to create an XCCDF Benchmark XML file ( which you could review in STIGViewer) from an HDF Profile JSON ( sans results ). This does not create an XCCDF-Results file from an HDF Results JSON file ( aka an inspec run )

For DOD / EMass DISA work - we usually use HDF Results JSON -> DISA Checklist

All the the above workflow could of course be put back into the SAF CLI but just wondering what your use-cases are and what workflow you are looking to start.

aaronlippold commented 1 year ago

Feel free to reach out on Slack as well to review this

HerbBoy commented 1 year ago

I apologize for wasting time here. This was a lack of understanding on my part and HDF2XCCDF works as we need it to. Thank you for such a quick response.

Before i close this, I saw Emily pushed through a possible fix for a issue i had open, was wondering when the next release will be cut? Thanks in advance

em-c-rod commented 1 year ago

We plan releases every Tuesday, so it should be out tomorrow.

HerbBoy commented 1 year ago

thank you!

aaronlippold commented 1 year ago

@Amndeep7 @wdower and @em-c-rod hdf_results2ckl is something that should be released in the next sprint or two, hdf_profile2xccdf_benchmark and spreadsheet2xccdf_results and spreadsheet2disa_checklist should also be put back on the todo's for the next release after that.