General Questions about reports

[Don Peddicord]

I am struggling to put together the pieces here for reports. 

The OVAL specs seem clear as to what an oval results xml file looks like. The schema defines the elements and their children. Industry standard tools can be used to validate and oval resutls file. 
Scap 1.3 requirements and validation of results are a whole different ball game.

1. The schema seems sparse.

2. Much of the schema appears to rely on schematron. 

3. The scapval tool appears to be the only tool that digests (albeit internally)  the schema, and it is unclear what reference files were used to validate the tool. Other tools such as saxon-HE, Oxygen, etc.

4. I can find no examples of complete results files (those which contain oval_results) 

I feel like I am missing the secret hyperlink to the rest of the information.

Can anyone help me?  

Thanks,

Don Peddicord

[David Solin]

 

Hi Don,

 

I can tell you that OVAL results (as defined by the OVAL results schema) are expected to be embedded as children of <report/> entities in the ARF XML output, as are XCCDF TestResults and also, potentially, OCIL results.  This is stated in the SCAP specification for v1.3 in section 4.4.1.  Also note that in section 4.5 of that specification document, the check hrefs in the TestResults must be rewritten to reference those specific reports (e.g., OVAL results) also appearing in the ARF.

 

I can provide you with a sample ARF report from an SCAP-validated tool, if having an example would prove illustrative.  Most email systems filter XML file attachments these days, so we’ll have to figure out a way for me to get it to you.

 

Best regards,

--David Solin

 

 

From: scap...@list.nist.gov <scap...@list.nist.gov> on behalf of Don Peddicord <imd...@gmail.com>
Date: Friday, April 15, 2022 at 2:00 PM
To: SCAP Discussion and Development <scap...@list.nist.gov>
Subject: [EXTERNAL] [scap-dev] General Questions about reports

[External]

 

---

-- 
To post to this group, send email to scap...@list.nist.gov
To unsubscribe from this group, send email to scap-dev+unsub...@list.nist.gov
Visit this group at https://list.nist.gov/scap-dev
--- 
To unsubscribe from this group and stop receiving emails from it, send an email to scap-dev+u...@list.nist.gov.