Perhaps it's beyond the scope of this script but identifying rules
without NIST controls would also be of value.
Number 5 could be tricky with respect to nested checks, some checks are
not referenced in the xccdf directly.
V/r,
Kevin Spargur
On 03/12/2012 10:26 PM, Shawn Wells wrote:
On 3/12/12 5:59 PM, Jeffrey Blank wrote:
> We'll shortly be committing a script to do checking for consistency
> between our OVAL and XCCDF. This should detect situations such as:
>
> 1)
> a reference from an XCCDF rule to an OVAL definition that doesn't exist.
>
> 2)
> an XCCDF rule exists (and is used in a profile) but doesn't include
> any reference to a check.
>
> 3)
> mismatch between filename and OVAL definition name (as this is an
> important convention for our approach to modular definitions)
I think the following would be helpful too:
4)
An XCCDF rule exists and isn't used in a profile
5)
Any checks that are not present in an XCCDF rule
(I can't imagine there would actually be any of these given how we've
been making XCCFD then the checks, but it'd be good to watch for)
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/scap-security-guide