Cross-referencing CCE's and Remediation scripts

Shawn Wells shawn at redhat.com
Mon May 19 20:26:51 UTC 2014


On 5/19/14, 4:09 PM, Shawn Wells wrote:
>
> On 5/19/14, 3:44 PM, Greg Elin wrote:
>> I've put together a web page to show which RHEL 6 CCE's have a remediation script from Aqueduct and SSG.
>>
>> It is interesting that a number of rules are missing CCE Idents. It is also easier to see the coverage of fix scripts.
>>
>> Http://www.govready.org/cce/fixes/
>>
>> Would love feedback and thoughts in how to improve coverage.
>
> This is very, very cool. Did you use some sort of XSLT for this, and 
> if so, is it sharable? Shipping something like this seems valuable, 
> with a link back to govready for a dynamic version.
>
> It doesn't seem to be picking up a few CCEs:
>
> aide_build_database - CCE 27135-3 (since 2013-10-30)
> bios_disable_usb_boot - CCE 26923-3 (since 2013-10-30)
>
> Is a refresh needed?

Went through a few more of the XCCDF rules manually and double checked 
on the CCEs. All *appears* well.

The code we use to transform out the CCEs from each XCCDF rule lives here:
https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL/6/transforms/xccdf2table-cce.xslt

And generates this HTML table:
http://people.redhat.com/swells/scap-security-guide/RHEL/6/output/table-rhel6-cces.html

Now that I'm done fretting if proper CCE assignments exist (mini heart 
attack due to the pending SSG inclusion in RHEL 6.6), I'd like to 
re-iterate, this is very cool!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140519/eb9b7cbb/attachment.html>


More information about the scap-security-guide mailing list