STIG Viewer. Quick Reference Guide

Transcription

1 STIG Viewer Quick Reference Guide

2 System Requirements STIG Viewer GUI Components The Savepoint Feature Opening a STIG Searching a STIG Options Menu Program Settings Creating a Checklist Parts of a Checklist Generating a Short-Form Checklist Saving a Checklist Import XCCDF Results Generating Results Files Table of Contents

3 System Requirements The STIG Viewer is a light-weight program that has very few system requirements. Requirements: A Graphical User Interface Windows XP or better Linux/Unix system with a GUI Java Runtime Environment (JRE) Version 6.17 or better

4 The STIG Viewer: GUI Components Imported STIGs Header Display Area XCCDF Profile Selection Filtered Search Rule List Content Display Area Tip: You can right-click on the Header and Content Display Areas to copy selected text to the system s clipboard.

5 The Savepoint Feature What is a Savepoint? A local folder in your user-local directory A place for the program to store settings and Imported STIGs A requirement for importing STIGs from ZIP files When to use it? On your own system When not to use it? On a system where you don t want to save any files

6 Opening a STIG Support is provided for opening directly from the xml or from ZIP files The STIG Viewer will only open XML files that have xccdf in the file name (as per the xccdf spec.)

7 Searching a STIG Inclusive(+) / Exclusive(-) Filtering Search Type Search Text Filter Control Buttons Filter List Tip: You can select one or more filters and use the delete key to remove them. Filtered Search: Filters can be added to or removed from the filter list. The Display List will show all STIG rules that match the full set of filters. Inclusive/Exclusive Searching Inclusive will show all results that match the specified criterion Exclusive will show all results that do NOT match the specified criterion Search Types Keyword - Searches all text Title -Searches only title text STIG ID -Searches STIG IDs RULE ID -Searches Rules IDs VUL ID -Searches Vul IDs IA Control -Searches the IA Control field CAT I -Filters by CAT Is CAT II -Filters by CAT IIs CAT III -Filters by CAT IIIs CCI Ref -Searches CCI reference data

8 The Options Menu The Options Menu provides access to Savepoint operations, as well as the Settings GUI Go to Program Settings if you want to: Adjust what information is shown in the display areas Adjust the FONT used in the display areas Adjust the FONT SIZE used in the display areas Adjust the Text Color used in the display areas Adjust the Background Color used in the display areas Tip: Whatever information is shown in the display areas is what is used when the rules are exported or printed. Keep this in mind if you only need to display a subset of the data provided in the STIG.

9 Program Settings (1/2) Tab Selection CCI Reference Display Options Display Area Field Selection *Note: The Displayed fields are the only ones which will be exported or printed from the STIG Viewer.

10 Program Settings (2/2) Font Options Color Selection

11 Creating a Checklist Checklists -A Checklist is an interactive list of vulns/rules -Either the entire STIG or the currently filtered list may be used when creating a checklist -Pre-existing checklists can be loaded in using Open Checklist from File

12 Vuln List This displays the status of vulns. You can set status by: -Selecting the Dropdown -Right-clicking on a selection of vulns -Using the hot keys --ctrl-r = Not Reviewed --ctrl-f = Open/Finding --ctrl-n = Not a Finding --ctrl-x = Not Applicable Items are color coded: White Not Reviewed Green Not a Finding Grey Not Applicable Red Open CAT I Orange Open CAT II Yellow Open CAT III Parts of a Checklist Current Check Status Set Severity Override STIG Information (Same as on the Viewer GUI) Metrics (Selecting different CAT levels will filter the Vuln List accordingly Finding Details -Required for Open Findings Comments Area Asset Data -Required for VMS import file generation

13 Short-form Checklist Short-Form Checklist A one-line listing of each vuln Provides circle-able Option: Open Not a Finding Not applicable Produced in HTML format, can be printed and used for manual review without printing multiple copies of the STIG

14 Saving a Checklist Saving a Checklist The * at the end of the title indicates the checklist has not been saved since it was last modified The File menu has Save and Save as Use Save As to save a renamed version of the checklist Use Save or Ctrl-S to save your progress on a checklist that has already been saved to the disk

15 Import XCCDF Results Import an XCCDF Results File This will map all results over the current checklist This will replace any existing results in the checklist Open findings will have their finding details populated automatically with the XCCDF results for that check

16 Generating Results Files Generating VMS Import Files Use this option to create a VMS XML file to import results into VMS The program will not allow this file to be generated if there are open findings with no finding details Only one Asset Posture may be loaded at a time -- if your checklist has multiple Asset Postures, multiple files must be created