Possibility of Fedora SCAP content to be served by SCAP security guide repository (either as subdirectory or via separated branch)?

Shawn Wells shawn at redhat.com
Tue Sep 3 19:24:30 UTC 2013


On 9/3/13 2:22 PM, Moessbauer, David wrote:
> Is there a matrix that can be referenced that will map the DISA STIG-ID (or Group ID) to the CCE Audit IDs?  ...or any other mapping that can be deduced
>
> In Example:
> Group ID (Vulid):  V-38487
> Group Title:  SRG-OS-000103
> Rule ID:  SV-50288r1_rule
> Rule Version (STIG-ID):  RHEL-06-000015


That metadata hasn't been added... to be honest, nobody has found the 
mappings meaningful enough to do. Can you help us understand how it'd 
benefit you?

Right now SSG rules are mapped back to the CCIs through various <ref> 
tags, e.g.:
<ref nist="AC-6,AU-9" disa="22,32" />

We could easily extend this to include a "stigid" name-pair value, 
should (a) the community be convinced this would help end-users, and (b) 
volunteers to perform the mapping


More information about the scap-security-guide mailing list