cingulara/openrmf-checklistdb repository overview

⁠openRMF Checklist Database

This is Deprecated now with the 0.8 and onward of OpenRMF.

This is one of many APIs for the openRMF tool by Cingulara. https://github.com/Cingulara/openrmf-docs⁠ has more information. The openRMF tool is a GPL-3.0 License open source tool that lets you perform better viewing, managing, exporting, and reporting (scoring) of your STIG checklists. It also generates RMF compliance against those checklists for a system that every single DoD IT person understands is a PITA! https://iase.disa.mil/stigs/Pages/index.aspx⁠ has more information on STIGs.

This specific image is the "Checklist" database that allows storing and retrieving of XML checklist data and metadata on the checklist. This is used by the Save, Upload, and Read APIs for the openRMF tool.

⁠Some of the things the openRMF performs:

• read the checklist XML
• save the checklist XML
• upload a checklist (with metadata) to a central repo to track
• download the XML for use in the actual viewer
• export a checklist to XLSX for better viewing, color coded to the status of the vulnerability
• listing vulnerabilities interactively through the web UI
• store a template checklist for a baseline to use (used if you reuse several for a baseline infrastructure for all applications)
• generate a compliance listing of NIST controls for RMF matched to all checklists within a system
• Filter by vulnerability status type

⁠Technologies used

There is a start.sh and stop.sh (with .cmd equivalents) to start and stop the whole stack of services for openRMF. It uses a stack.yml with docker-compose -f stack.yml up syntax at https://github.com/Cingulara/openrmf-docs/blob/master/stack.yml⁠.

• dotnet core 2.2 web api in C#
• NATS C# client
• MongoDB NuGet driver
• CQRS = command query responsibility segregation
• Eventual consistency
• Microservices, some with their own DB, some with a shared db

⁠Note

The Save, Upload, and Read API needs the openrmf-checklistdb MongoDB or another one similar to the description in the repo at https://github.com/Cingulara/openrmf-api-read⁠. This database is one of the tools in the openRMF tool to have a distributed system whose goal is to make a better management and user experience for the DISA STIGs and STIG viewer at https://iase.disa.mil/stigs/Pages/index.aspx⁠.