SCAP Import Wizard Issue

Usage and Config Security
1

(imported topic written by MichaelG91)

Hello All,

I have been trying to import the benchmark XCCDF/OVAL content from DISA contained in their STIG’s. However, I have run into the issue where there are no checks that I can report from this content I have tried a few but all of them are reported empty by the wizard for all profiles. Additionally importing the oval definitions directly results in the following error:

XML validation error: There was an error: Died at /<C:\Users\Administrator.CIC\AppData\Local\BigFix\Enterprise Console\BES_bfenterprise****\Sites\SCM Reporting\SCAPEval.exe>XCCDF/Base.pm line 78.

While I have tried a variety of the content I will just give a link to one that I know does not work:

http://iase.disa.mil/stigs/content_pages/windows_os_security.html

Windows XP STIG, Version 6, Release 1.19

Regards,

-Michael

2

(imported comment written by Eric Walker)

Hi Michael,

When I look at the zip archive for XP that is linked from the page you point to, I don’t see any OVAL files. The only XCCDF file I see is U_Windows_XP_V6R1.20_STIG_Manual-XCCDF.xml, which can be used to generate documentation, but not by our wizard, which generates TEM (BigFix) content from fully automatable SCAP content (which will include one or more OVAL files).

There is a PDF in the same zip file that explains a little more and includes file names that are similar to what you would expect to see if machine-consumable SCAP content were present – see U_STIG_Transition_to_XCCDF_FAQ_20100126.pdf.

Please let me know if I’ve missed an important point.

All the best,

Eric