cingulara/openstig-web repository overview

⁠openSTIG tool

This is a web based tool for viewing the DISA STIG checklists in a nice, simple web based way. It consists of a UI, several APIs, 1 (for now) messaging service using NATS, as well as 3 Mongo DBs (for now) that help you manage, report on, and use the DISA STIGs and STIG Viewer to report on security specifics for DoD applications, networks, systems, etc. I did not like (a.k.a hate!) the STIG Viewer experience at all so I wanted something to manage it and do all the manual things I was asked to do, but in an automated fashion. All the code is on GitHub under https://www.github.com/cingulara/⁠ and is under GPL 3.

⁠Some of the things the openSTIG performs:

• read the checklist XML
• save the checklist XML
• upload a checklist (with metadata) to a central repo to track
• download the XML for use in the actual viewer
• export a checklist to XLSX for better viewing, color coded by status
• store a template checklist for a baseline to use (used if you reuse several for a baseline infrastructure for all applications)
• generate a compliance listing of NIST controls for RMF matched to all checklists within a system

There is a stack.yml to use with docker-compose -f stack.yml up syntax at https://github.com/Cingulara/openstig-docs/blob/master/stack.yml⁠

⁠Technologies Used

• dotnet core 2.2 web api in C#
• NATS C# client
• MongoDB NuGet driver
• CQRS = command query responsibility segregation
• Eventual consistency
• Microservices, some with their own DB, some with a shared db