XCCDF-Results to HDF #103
XCCDF-Results to HDF #103
Conversation
zacharylc-mitre
force-pushed
the
scc-converter
branch
from
69f6560
to
bc0d1a8
Compare
|
needs a rebase |
|
The SCC xml sample doesn't seem to produce the check-content field, as seen in the base (non-results) xccdf of the STIG. Otherwise, mappings look correct. Is it possible to see a generic expected xccdf results xml that isn't generated by any particular client? Otherwise, I fear this has been tailored to SCC's own special XML interpretation, and therefore should be renamed "SCC-xxcdf-mapper" Actual STIG: Sample from SCC (lacks Check Text): |
|
@zacharylc-mitre Please resolve merge conflicts on the Readme |
|
@zacharylc-mitre I agree with @ejaronne that the scope should be limited to SCC xccdf type. Possibly Besides |
README.md
Outdated
| 10. [**scoutsuite_mapper**](#scoutsuite_mapper) - multi-cloud security auditing tool | ||
| 11. [**snyk_mapper**](#snyk_mapper) - commercial package vulnerability scanner | ||
| 12. [**sonarqube_mapper**](#sonarqube_mapper) - open-source static code analysis tool | ||
| 13. [**xccdf_results_mapper**](#xccdf_results_mapper) - SCC Client XCCDF-Results scans |
There was a problem hiding this comment.
Update to SCC Compliance Validation tool
|
It was originally named xccdf_mapper which I renamed to xccdf_results because the XCCDF schema and the XCCDF-results schema are different. Can we point to a SCC XCCDF-Results schema? I'm trying to call it what it is. Maybe we just call it an SCC mapper. |
|
Eventually, @aaronlippold wanted this to translate any client that generates the xccdf_results format. This has only been tested to convert SCC output. I agree though that leading with xccdf_results_mapper will go over the heads of many non-data-schema folks who just want that "SCAP mapper", but won't see it. How about we revamp: The upper list should have links to the converters later in the README. In the upper list, put in an entry called "SCC (SCAP Compliance Checker) results mapper", but link it to the xccdf_results_mapper later in the README. As the xccdf_results_mapper adapts to work with other SCAP validated tools such as OpenSCAP, place a new entry in the upper list, but link it to the same xcddf_results_mapper lower on the list. |
|
Adding some notes for info looks like openscap scc
https://csrc.nist.rip/library/alt-SP800-126r3.pdf |
|
Taking back my objection re |
|
Okay so it seems the way ahead should just update the README to be clear |
Added mapping tool for SCC XCCDF-Results to HDF Made changes to heimdall_tools.rb and cli.rb to account for xccdf_mapper* Signed-off-by: zacharylc <zacharylc@mitre.org>
Signed-off-by: zacharylc-mitre <72886517+zacharylc-mitre@users.noreply.github.com>
Signed-off-by: zacharylc <zacharylc@mitre.org>
Rename xccdf_mapper to xccdf_results_mapper
Fixes #95
Signed-off-by: zacharylc zacharylc@mitre.org