Import and Update SCAP (XML)

You can import an existing SCAP (XML) Benchmark into Slang with the Slang Authoring Toolkit.

For example, you can:

  • Create new rules.
  • Customize check logic.
  • Change the embedded remediation guidance.

These sample procedures use Windows 10 STIG as the sample SCAP. You can import your own SCAP as well.

These actions are required:

Download and import SCAP

  1. Navigate to the SCAP. If you do not already have the SCAP on your machine, download it.
    For example, in the list of SCAP-formatted STIGs on the Department of Defense (DoD) Cyber Exchange, download the Microsoft Windows 10 STIG Benchmark.
  2. Open Visual Studio Code (VS Code) and a terminal.
  3. In the terminal, run this command to import the STIG and create a new Slang project:
    SHELL 
    slang import <filepath> <project_name>
    Where:
    • filepath is the file path of the STIG.
    • project_name is the name of your new Slang project.

Update the project-wide settings

  1. In VS Code, select File > Open Folder, and then navigate to ~/Slang/project_name, where project_name is the name of your porject.
  2. Open the project.slang file.
  3. Edit the title and description to indicate that this is your version of the STIG.
  4. Edit the id_namespace to a valid reverse-DNS style string associated with you or your organization. Use letters, numbers, periods, hyphens only.
    Tip: A reverse-DNS style string has the components listed backwards from a normal domain. For example, com.example.business instead of business.example.com.
  5. Click Save.

Adjust the project rules

Do one or more of these actions:

Add a rule to a project

  1. In VS Code, create a folder, and then name it based on the rule.
  2. Create a file, and then name it rule_id.slang, where rule_id is an ID for your rule.
  3. In the rule_id.slang file, add the rule content.
    For example:
    YAML 
    Rule:
    title: The system must be configured to audit DPAPI Activity failures.
    checks: 
      - windows.audit_policy.subcategory:
        dpapi_activity: failure only
  4. Click Save.

Remove a rule from a project

There are two ways that you can remove a rule from a project. Based on your needs, do one of these actions:

  • Delete the file.
  • Remove the rule through a slang profile.
    1. Create a file in the main project folder, and then name it profile.profile_name.slang, where profile_name is a name for your new profile.
    2. Add this content:
      YAML 
      Profile:
    title: <profile_name>
      Where:
      • profile_name is the name of your profile.
    3. Add the select_all_rules_except parameter and any applicable values.
      For example:
      YAML 
      select_all_rules_except:
    - SV-220924r569187_rule.slang
    4. Click Save.

Customize a rule

  1. In VS Code, open the rule_id.slang file, where rule_id is the ID of the rule that you want to customize.
  2. Edit Title as applicable.
  3. Delete any irrelevant tags.
  4. Edit the description.
  5. Edit the check:
    1. Remove the imported OVAL check from common.oval.
    2. Enter windows. to see a list of suggested checks.
    3. Select an option.
  6. Edit the audit policy:
    1. Select windows.audit_policy.subcategory.
    2. Press Ctrl+Space to see suggestions.
    3. Select an option.
  7. Edit the validation:
    1. Select credential_validation.
    2. Press Ctrl+Space to see suggestions.
    3. Select an option.
      For example, the success and failure option updates the checks section to:
      YAML 
      checks:
  -  windows.audit_policy.subcategory:
     credential_validation: success and failure
  8. Save the file.

Export Slang to SCAP (XML)

In a terminal, press Ctrl+`, and then run this command to export your Slang project to SCAP (XML):
SHELL 
slang export <project_name> <project_name>.xml
Where:
  • project_name is the name of your Slang project.

A new folder named exported_scap appears in your project appears at the base of your project directory. For example, ~/Slang/example_project/exported_scap. The folder contains the XML file.

Tip: If you have access to a Windows 10 scan target and have completed Test a Slang project, run this command to export and test your project using the profile created:
SHELL 
slang export <project_name> <project_name>.xml --scan_config <config_name> --profile profile.<profile_name>.slang
When you review the results, look for your DPAPI rule. Filter to NOT SELECTED and the rule that was removed in Remove a rule from a project appears.