mitre / inspec-developer-v1 Goto Github PK

Section 4.5 has 2 instances of inputs being assigned to a variable. We discussed using them directly with matchers going forward.

9.1 - Here is your STIG XCCDF File
a. Look at it in S TIGViewer ( standard apprach )
b. Look at it in Heimdall LIte ( ???? )

9.2 - SAF CLI generate - Creaing the 'bones' of your profile / controls
a. Creates our stubs does our mapping etc.
b. Creates the base of our proifle etc

9.3 - ( current 9.2 ) ... but let's break it into two steps
a. The STUB with out describe blocks ( aka new 9.2 output )
b. what we have there now ...
c. Brings us to "current 9.3" - Students work on your controls

9..4 -> current 9.3 work on your code

Remove current 9.4 as it adds no value, perhaps update it to the list of controls that we set to NA with there justifications as that is a more useful dicission topic.

It was pointed out that the versions on this page needed to be updated

“For this basic class, knowledge of basic programming concepts, modern language conventions and some working experience with a modern language (e.g., ruby, python, go, etc) is useful. (Inspec is a Ruby Domain-specific language (DSL)). To become more familiar with Ruby, feel free to review the following Ruby primers:
https://www.ruby-lang.org/en/documentation/quickstart/
https://www.youtube.com/watch?v=t_ispmWmdjY&vl=en”

Break Section 4 into Three Parts:

1. InSpec Shell
2. Basic Resource
3. The INs and Outs of Inputs ... the many ways inputs are a very useful tools in our belt
   a. testing data
   b. stateful testing
   c. smaller overlay or org nuance
   d. asldfkjaldfj

See chrome:latest

dependabot filing a lot of prs

How is this differnt or not part of Section 11?

Should Section 11 be removed?

1. Code Background & Primers

• Ruby
• RSpec
• InSpec Docs

2. Codespaces and Git Links and Docs

• Git Primer and Intro
• Codespaces Documentation

3. Downloads and Tools

• InSpec
• Cinc
• VSCode
• Codespaces

4. STIGs and Benchmarks

• RHEL8 STIG - public.cyber.mil
• RHEL8 InSpec Profile
• CIS RHEL8 Benchmark ( for background )
• Webserver SRG docs - public.cyber
• nginx-srg-baseline-proifle

Secion 5 seems to be 'generating results' and section 6 seems to be viewing and analysing results.

Heimdall Tools is not active any more so lets not reference it

I think we need to add a bit more meat to these sections as well

The following command led to an error:

inspec supermarket exec dev-sec/nginx-baseline -i ~/inspec.pem -t ssh://[email protected]:22 --sudo

Section reference

We discussed using RHEL7 instead of RHEL6
Agreeing on this change would require a lot of modifications on this page