cingulara/openrmf-scoredb repository overview

⁠openRMF Score Database

This is Deprecated now with the 0.8 and onward of OpenRMF.

This is one of many APIs for the openRMF tool by Cingulara. https://github.com/Cingulara/openrmf-docs⁠ has more information. The openRMF tool is a GPL-3.0 License open source tool that lets you perform better viewing, managing, exporting, and reporting (scoring) of your STIG checklists. It also generates RMF compliance against those checklists for a system that every single DoD IT person understands is a PITA! https://iase.disa.mil/stigs/Pages/index.aspx⁠ has more information on STIGs.

This specific image is the "Score" database that allows storing and retrieving of XML checklist data scoring metadata. The openrmf-msg-score subscribes to "save" events and stores the data in this database. The openrmf-api-scoring reads from this database to show the score in JSON or XML format depending on the Accept header.

⁠Some of the things the openRMF performs:

• read the checklist XML
• save the checklist XML
• upload a checklist (with metadata) to a central repo to track
• download the XML for use in the actual viewer
• export a checklist to XLSX for better viewing, color coded to the status of the vulnerability
• listing vulnerabilities interactively through the web UI
• store a template checklist for a baseline to use (used if you reuse several for a baseline infrastructure for all applications)
• generate a compliance listing of NIST controls for RMF matched to all checklists within a system
• Filter by vulnerability status type

⁠Technologies used

There is a start.sh and stop.sh (with .cmd equivalents) to start and stop the whole stack of services for openRMF. It uses a stack.yml with docker-compose -f stack.yml up syntax at https://github.com/Cingulara/openrmf-docs/blob/master/stack.yml⁠.

• dotnet core 2.2 web api in C#
• NATS C# client
• MongoDB NuGet driver
• CQRS = command query responsibility segregation
• Eventual consistency
• Microservices, some with their own DB, some with a shared db

⁠Note

The Scoring API and Score subscription microservice (openrmf-msg-score) needs the openrmf-scoredb MongoDB or another one similar to the description in the repo at https://github.com/Cingulara/openrmf-msg-score⁠. This database is one of the tools in the openRMF tool to have a distributed system whose goal is to make a better management and user experience for the DISA STIGs and STIG viewer at https://iase.disa.mil/stigs/Pages/index.aspx⁠.