Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Checklist is generated with no status changes #1037

Open
sgtwtf opened this issue Jan 6, 2022 · 1 comment
Open

Checklist is generated with no status changes #1037

sgtwtf opened this issue Jan 6, 2022 · 1 comment

Comments

@sgtwtf
Copy link

sgtwtf commented Jan 6, 2022

Describe the bug
Ran Start-DSCEAscan -moffile (moffile.xlm) -computername localhost -outputfile c:\folder\ and it generates a results...xml file
Tried to import that into DISA STIG viewer but it error about the file so I generated a checklist.
"New-StigCheckList -ReferenceConfiguration $ReferenceConfiguration -XccdfPath $XccdfPath -OutputPath $outputPath" this generated a checklist file checklist.ckl but all of the status are set to not reviewed for results that the XML file show as False under "DesiredState"

To Reproduce

  1. Run Start-DSCEAscan -moffile (moffile.xlm) -computername localhost -outputfile c:\folder\ and it generates a results...xml as expected
  2. New-StigCheckList -ReferenceConfiguration $ReferenceConfiguration -XccdfPath $XccdfPath -OutputPath $outputPath the checklist has all the set to "not reviewed" despite the findings in the xml file.

Expected behavior
I would expect the checklist to get updated from the XML results file to reflect the scan results.

Screenshots
no errors

Additional context
none

@ImperatorRuscal
Copy link

At the very least, you are using the wrong call for New-StigCheckList. Using the -ReferenceConfiguration parameter causes the command to create an entirely unreviewed checklist based on the MOF. This is basically the same as creating a checklist in STIG Viewer and assigning the various STIGs you included in your DSC profile.

Instead, you want to use the -DscResult parameter group.

First capture the results of your DSCEAscan back into a PowerShell object.
$auditResults = Import-CliXml "C:\folder\results...xml"
Then create the checklist based on the results, not based on the reference document
New-StigCheckList -DscResult $auditResults -XccdfPath $XccdfPath -OutputPath $outPath

That is how you're supposed to create a checklist file based upon the DCS scan results.

Note that as I write this I'm searching the board for issues with setting the STATUS element in the checklist file created by using the -DcsResults parameter group -- On my test PC the status for each STIG is still showing "not reviewed" instead of "open" or "no finding." So you may still have issue (I haven't seen if this is systemic or just my one test PC), but at least this is the proper way to attempt it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants