Import into STIGManager from Evaluate-STIG only processes the last CKL file scanned

[CWBISAST]

Is there an existing issue for this?

• I have searched the existing issues

Are you using the latest version of STIG Manager?

• I am using the latest Release.
• I am NOT using the latest Release. I am aware that the first thing I will be asked to do is update the application so that I have the latest bugfixes.

Where are you experiencing the issue?

• API
• UI or other client
• Deployment
• Elsewhere

Current Behavior

When performing an evaluation using evaluate-STIG that encompasses multiple STIGs or multiple instances of a single STIG on a given system, only the last file processed is uploaded to STIGManager. I worked with the Evaluate-STIG dev team and determined Evaluate-STIG is sending all the data across, but only the last one is being added to STIGManager.

Expected Behavior

All STIGs sent by Evaluate-STIG should be loaded into STIGManager

Steps To Reproduce

This was originally noticed on a web server. Evaluate-STIG properly assesses the Apache Server STIG, multiple Apache Site STIGS and the operating system STIG (in that order). The appropriate .CKL files are generated in the OutputPath. However, only the OS STIG is uploaded to STIG Manager. I then did a --SelectSTIG to specify the Apache Server STIG be evaluated separately, and that loaded to STIGManager correctly, so I know it's not Apache that is the issue. Finally, I ran the Site STIG separately, and although it evaluated 65 sites and produced CKL files for each, only the last one processed was pushed to STIGManager. I added debug code to Evaluate-STIG, and found that every STIG sent except the last receives a response of "@{ruleId=SV-214233r960900_rule; reason=no grant for this asset/ruleId}". If you load the STIG individually it works, but if it is loaded via the queue, it fails. Also working issue https://spork.navsea.navy.mil/nswc-crane-division/evaluate-stig/-/issues/2029#note_622921 with the Evaluate-STIG team as I am unsure where the issue is.

Can you provide screenshots, logs, or other useful artifacts?

No response

Describe your Environment

- Hosting: STIGManager 1.4.18 running in a container in AWS.
- Browser: NA / Evaluate-STIG_1.2410.0 pushing data
- OS: Oracle Enterprise Linux 8 and Ubuntu 20.04 LTS
- Node: ??
- npm: ??

[cd-rite]

Hi @CWBISAST reason=no grant for this asset/ruleId usually indicates that that rule is not part of a STIG that has been assigned to that Asset, or that is from a Revision of a STIG not in STIG Manager.

The issue of only seeing the latest scan sounds like it would be on the Evaluate STIG side. STIGMan doesn't even get the checklists, the data is processed on the client side into requests to create assets, assign stigs, add reviews, etc.

Since you mention web servers, those STIGs are usually broken out into hostnames in the style of <HOST_NAME>-[<WEB_DB_SITE> | "NA"]-[<WEB_DB_INSTANCE> | "NA"], described here: https://stig-manager.readthedocs.io/en/latest/installation-and-setup/data-and-permissions.html#ckl-processing
It's possible Eval-STIG is not handling this properly?

Closing this, since it doesn't sound like the issue is on the STIGMan side. Feel free to reopen or add a comment if you get more info though!

[CWBISAST]

If I take the resulting CKL files and manually drop them into STIGManager, it imports them 100%. It's not a matter of the STIG not being assigned to the asset. It is, but it still rejects with that message. It is only when processing them through the direct feed from Evaluate-STIG that they are rejected by STIGManager. If I run the Apache Site STIG separately (--selectSTIG), it only accepts results from the LAST site evaluated. All other sites are rejected. Same server, just different sites.

[cd-rite]

Hi @CWBISAST Yep, from what you are saying, this sounds like it's a problem with Eval-STIG when it acts as a client for the STIG Manager API. It may be trying to assign results to the wrong Asset Id. It may be fetching the asset that matches the base hostname, instead of the extended hostnames constructed for site/db assets. Eval-STIG should be emulating the asset name construction mentioned above when it tries to assign results to site/db assets, but they may not be doing that as expected.