OpenSCAP Tailoring - Possible to change rule severity

Question

Is it possible to change the severity of a rule using an OpenSCAP tailoring/customization file?

UPDATE (2022-04-13):

refine-rule seems like it could solve this but cannot find any documentation for whether you can use this in the customisation file.

Answer 1

Profiles are defined in the repository : ComplianceAsCode/content

You can copy the desired configuration file to new file (or download the latest release from GitHub) and then edit the severity of the rules according to your needs.

The example bellow edit the severity if the auditd service is disabled on macOS:

• On the file ssg-macos10-15-ds.xml find the line bellow:

<xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_service_com_apple_auditd_enabled" selected="false" role="full" severity="high">

• Change the severity from high to low

<xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_service_com_apple_auditd_enabled" selected="false" role="full" severity="low">

Note that the severity value can be unknown, info, low, medium or high

• Save and use the modified profile:

 oscap xccdf eval --profile xccdf_org.ssgproject.content_benchmark_macOS-1015 --results-arf results.xml --report report.html /path/to/new/edited/ssg-macos10-15-ds.xml

Where: xccdf_org.ssgproject.content_benchmark_macOS-1015 is the id of the benchmark as defined on the profile : <xccdf-1.2:Benchmark id="xccdf_org.ssgproject.content_benchmark_macOS-1015" resolved="1" xml:lang="en-US" style="SCAP_1.2">

Updates

Indeed, refine-rule can be used to change the weight, severity and role of a rule.

After saving the "Customization only", you can edit the rules in the XML file by adding for each rule the refine-rule according to your need :

<?xml version="1.0" encoding="UTF-8"?>
<xccdf:Tailoring xmlns:xccdf="http://checklists.nist.gov/xccdf/1.2" id="xccdf_scap-workbench_tailoring_default">
  <xccdf:benchmark href="/tmp/scap-workbench-HdQHny/ssg-rl8-ds.xml"/>
  <xccdf:version time="2022-04-16T15:02:00">1</xccdf:version>
  <xccdf:Profile id="xccdf_org.ssgproject.content_profile_cui_customized" extends="xccdf_org.ssgproject.content_profile_cui">
    <xccdf:title xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171) [CUST$
    <xccdf:description xmlns:xhtml="http://www.w3.org/1999/xhtml" xml:lang="en-US" override="true">From NIST 800-171, Section 2.2:
Security requirements for protecting the confidentiality of CUI in nonfederal
information systems and organizations have a well-defined structure that
consists of:

(i) a basic security requirements section;
(ii) a derived security requirements section.

... 

"</xccdf:description>
    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" selected="true"/>
    <xccdf:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events" selected="true"/>
    <xccdf:refine-rule idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" weight="0" severity="low"/>
    <xccdf:refine-rule idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events" weight="0" severity="low"/>
  </xccdf:Profile>
</xccdf:Tailoring>

Result

• Without customization

• With customization

More information can be found in Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.2 in section 6.5.3

Debug

Testing the profile

 oscap info --profile xccdf_org.ssgproject.content_profile_cui_customized ./ssg-rl8-ds-tailoring.xml
Document type: XCCDF Tailoring
Imported: 2022-04-18T06:04:53
Benchmark Hint: /tmp/scap-workbench-FGmUva/ssg-rl8-ds.xml
Profiles:
    Title: Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171) [CUSTOMIZED]
        Id: xccdf_org.ssgproject.content_profile_cui_customized

Where xccdf_org.ssgproject.content_profile_cui_customizedis the Profile-id on the tailoring file ssg-rl8-ds-tailoring.xml.

Generating guide

oscap xccdf generate guide --verbose INFO --fetch-remote-resources --profile xccdf_org.ssgproject.content_profile_cui_customized  --output guide-profile_cui_customized.html --tailoring-file ./ssg-rl8-ds-tailoring.xml ./ssg-rl8-ds-tailoring.xml

On the generated guide, you can verify if the rule is as expected and that also can be used as reference for your custom tailoring profile.