For those working on hashing out the Severity Category Codes (e.g. CAT
levels) of the <rule>'s, our friends at DISA FSO have provided an
updated "category code definitions" table. Thank you!
I have posted it the the STIG Wiki Page:
https://fedorahosted.org/scap-security-guide/wiki/rhel6stig
And a direct link:
https://fedorahosted.org/scap-security-guide/raw-attachment/wiki/rhel6sti...
Note that we must use "low," "medium," and "high" and not
the CAT
levels, so;
CAT I == High
CAT II == Medium
CAT III = Low
As a reminder, all rules default to "low" unless otherwise specified via
the "severity" tag, examples:
system/network/uncommon.xml:36:<Rule id="disable_protocol_sctp"
severity="medium">
services/obsolete.xml:180:<Rule id="no_rsh_trust_files"
severity="high">
--
Shawn Wells
Technical Director,
U.S. Intelligence Programs
(e) shawn(a)redhat.com
(c) 443.534.0130