Import and Update SCAP (XML)
Updated Aug 30, 2023Import and Update SCAP (XML)
With the Slang Authoring Toolkit, you can import an existing SCAP (XML) Benchmark into Slang. For example, you can:
- Create new rules.
- Customize check logic.
- Change the embedded remediation guidance.
These sample procedures use Windows 10 STIG as the sample SCAP. You can import your own SCAP as well.
Before you begin
Steps
- Download and import SCAP.
- Update the project-wide settings.
- Adjust rules.
- Export Slang to SCAP (XML).
Step 1: Download and import SCAP
-
Download or navigate to the SCAP.
For example, download the Microsoft Windows 10 STIG Benchmark from the list of SCAP-formatted STIGs on the Department of Defence (DoD) Cyber Exchange.
-
Open Visual Studio Code (VS Code) and a CLI.
-
Run this command to import the STIG and create a new Slang project:
slang import <filepath> <project_name>
Step 2: Update the project-wide settings
-
In VS Code, select File > Open Folder and navigate to
~/Slang/<project_name>
. -
Open the
project.slang
file. -
Change the title and description to indicate this is your version of the STIG.
-
Change the
id_namespace
.This should be a valid reverse-DNS style string associated with you or your organization. Use letters, numbers, periods, hyphens only.
-
Click Save.
Step 3: Adjust rules
You can add, remove, and customize rules for your project.
Add a rule to a project
-
In VS Code, create a folder, naming it after the rule.
-
Create a file titled
<rule_id>.slang
and add rule content.For example:
Rule: title: The system must be configured to audit DPAPI Activity failures. checks: - windows.audit_policy.subcategory: dpapi_activity: failure only
-
Click Save.
Remove a rule from a project
There are two ways that you can remove a rule from a project. You can simply delete the file, or leave the file in place and remove the rule through a slang profile. To remove a rule without deleting the file:
-
Create a file in the main project folder, next to
project.slang
, calledprofile.<profile_name>.slang
. -
Add the following content:
Profile: title: <profile_name>
-
Add the
select_all_rules_except
parameter and any applicable values.For example:
select_all_rules_except: - SV-220924r569187_rule.slang
-
Click Save.
Customize a rule
- In VS Code, open the
<rule_id>.slang
file. - Change
Title
as applicable. - Delete any irrelevant tags.
- Edit the description.
- Edit the check:
- Delete the imported OVAL check from
common.oval
. - Type
windows.
to see a list of suggested checks. - Select an option.
- Delete the imported OVAL check from
- Edit the audit policy:
- Select
windows.audit_policy.subcategory
. - Press Ctrl+Space to see suggestions.
- Select an option.
- Select
- Edit the validation:
-
Select
credential_validation
. -
Press Ctrl+Space to see suggestions.
-
Select an option.
For example, selecting
success and failure
updates the checks section to:checks: - windows.audit_policy.subcategory: credential_validation: success and failure
-
- Save the rule file.
Step 4: Export Slang to SCAP (XML)
- In the Terminal press Ctrl+` and then run this command to export your Slang project to SCAP (XML):
slang export <project_name> <project_name>.xml
exported_scap
, which contains the XML file.Tip: If you have access to a Windows 10 scan target and have completed Test a Slang project, run
lang export <project_name> <project_name>.xml --scan_config <config_name> --profile profile.<profile_name>.slang
to export and test your project using the profile created. When you review the results, look for yourDPAPI
rule. Filter to NOT SELECTED and rule that was removed in Remove a rule from a project appears.