cingulara/openstig-api-controls repository overview

⁠Update

This tool is now titled openRMF. The equivalent API to reference from here out is https://hub.docker.com/r/cingulara/openrmf-api-controls⁠.

⁠Description

This is one of many APIs for the openSTIG tool by Cingulara. https://github.com/Cingulara/openstig-docs⁠ has more information. The openSTIG tool is a GPL-3.0 License open source tool that lets you perform better viewing, managing, exporting, and reporting (scoring) of your STIG checklists that every single DoD IT person understands is a PITA! https://iase.disa.mil/stigs/Pages/index.aspx⁠ has more information on STIGs.

This specific image is the "Controls" API that lists all NIST controls for a Risk Management Framework (RMF). This is used with the openSTIG Compliance API to match the controls to checklists.

⁠Some of the things the openSTIG performs:

• read the checklist XML
• save the checklist XML
• upload a checklist (with metadata) to a central repo to track
• download the XML for use in the actual viewer
• export a checklist to XLSX for better viewing, color coded to the status of the vulnerability
• listing vulnerabilities interactively through the web UI
• store a template checklist for a baseline to use (used if you reuse several for a baseline infrastructure for all applications)
• generate a compliance listing of NIST controls for RMF matched to all checklists within a system

⁠Technologies used

There is a stack.yml to use with docker-compose -f stack.yml up syntax at https://github.com/Cingulara/openstig-docs/blob/master/stack.yml⁠

• dotnet core 2.2 web api in C#
• NATS C# client
• MongoDB NuGet driver
• CQRS = command query responsibility segregation
• Eventual consistency
• Microservices, some with their own DB, some with a shared db