+
+
-
-# Configuration
-
-## Administrator Login
-
-The default Local Administrator Username is admin@tir.local. The initial
-password will be provided. Enter your admin@tir.local and the initial
-**Password**, then review the **IS User Agreement** and acknowledge that
-you have read it by clicking the check box. Then, click **Sign in**.
-
-
-
-- After successfully logging in for the first time, please change the
- TIR Admin password by completing the following:
-
-- Click the Profile Icon in the upper right corner of the welcome
- screen.
-
-
+
+
+
+
Table 1: Access Control – User Permissions
+ +### Changing Company and Boundary Permissions + +To add or modify Company and Boundary permissions, select the 3 buttons to the far right of the Company or Boundary and select Manage Members. + +
+
+
+
Figure 1: Modify Company/Boundary Permissions
+ +#### Adding Users + +Clicking the **Manage Members** will display the Members dialog box, enter the username in the **Search Users** box. + +
+
+
+
Figure 2: Adding Members – Search Users
+ +The Search Users box should provide a list of similar usernames. Select the user account you wish to add. Once selected click the down arrow next to Co-Owner and select the level of permission you wish to grant. + +
+
+
+
Figure 3: Manage Members – Choose level of Access
+ +Once the level of access you wish to grant is selected, click **Add Member**. You will see the account added to the user permissions list for the applicable company/boundary. + +
+
+
+
Figure 4: Member Access – User Added with Co-owner Role
+ +Member access can be edited or removed from this view as well. This process is the same for both Companies and Boundaries. + +#### Editing User Permissions + +Clicking the **Manage Members** will display the Members dialog box. Click the **Edit** button next to the user you wish change permissions for. + +
+
+
+
Figure 5: Edit User Permissions
+ +This will enable the drop-down menu for the role field. To change the user's role, select the new role and click the **Save** button for that user. There is one limitation when editing roles, and that is that each boundary needs to have an Owner. If you are changing the role of user from Owner to Editor, you will first need to assign another user the Owner role. + +
+
+
+
Figure 6: Edit User Role
+ +To remove a user, click the **Remove** button for that user. Owners can not be removed. If you wish to remove an owner from a Company or Boundary you must first grant another user the Owner role. + +
+
+
+
Figure 7: Remove User
+ +## Configuration + +### Administrator Login + +The default Local Administrator Username is admin@tir.local. The initial password will be provided. Enter your admin@tir.local and the initial **Password**, then review the **IS User Agreement** and acknowledge that you have read it by clicking the check box. Then, click **Sign in**. + +
+
+
+
Figure 8: Login Page
+ +- After successfully logging in for the first time, please change the TIR Admin password by completing the following: + +- Click the Profile Icon in the upper right corner of the welcome screen. + +
+
+
+
Figure 9: Selecting Your Profile
- Click Your **Profile** to bring up the TIR Admin profile. -
+
+
+
+
Figure 10: Changing The Local Admin Password
- In the **Password** row select **Change** -
+
+
+
+
Figure 11: Changing the Local Admin Password
- Enter **New password** @@ -63,91 +161,147 @@ style="width:4.77808in;height:3.26656in" /> - Select Save -## Administrative Functions +### Administrative Functions -The TIR Local Administrator account is allowed to perform a number of -configuration tasks, like creating local accounts, setting up LDAP, -uploading certificates, and configurating centralized Logging. These -functions are executed in the **Administration** Tab. +The TIR Local Administrator account is allowed to perform a number of configuration tasks, like creating local accounts, setting up LDAP, uploading certificates, and configurating centralized Logging. These functions are executed in the **Administration** Tab. -1. **The Administration Tab** +#### The Administration Tab -The **Administration** tab is only available through Administrators. You -access the **Administration** tab by selecting **Administration** at the -top center of the web interface. +The **Administration** tab is only available through Administrators. You access the **Administration** tab by selecting **Administration** at the top center of the web interface. -
+
+
+
+
Figure 12: Location of the Administration Tab
-The four major **Administration** tab functions are configuration, -Notifications, Users, and Logs. +The four major **Administration** tab functions are configuration, Notifications, Users, and Logs. A view of the **Administration** tab is below: -
+
+
+
+
Figure 13: Administration Tab
-#### Configuring LDAP +##### Configuring LDAP -LDAP is configured during TIR deployment. Please see the TIR Deployment -Guide for LDAP configuration procedures. +LDAP is configured during TIR deployment. Please see the TIR Deployment Guide for LDAP configuration procedures. -#### Configuration +##### Configuration -Within the **Configuration** section an Administrator can change -standard **Terminology** and import a **CA Certificate.** +Within the **Configuration** section an Administrator can change standard **Terminology** and import a **CA Certificate.** -
+
+
+
+
Figure 14: Configuration Functions
##### Certificate Import and Verification -- Click on the **CA Certificate** **Choose File** box to open a File - dialog window and choose your signed x509 formatted .crt file and - hit **Open** - the name of the file will appear in the **CA - Certificate** Text Box - -
-
-
+- Click on the **CA Certificate** **Choose File** box to open a File dialog window and choose your signed x509 formatted .crt file and hit **Open** - the name of the file will appear in the **CA Certificate** Text Box
+
+
+
+
+
Figure 15: Import Certificates
+ +
+
+
+
Figure 16: Choosing Certificate
- Note name of .crt file shows up in text field. -
-
-- Click on the **Site Certificate** Choose File box to open a File
- dialog window and choose your .pem formatted site key and hit Open -
- the name of the file will appear in the Site Certificate Text Box
-
-
-
-
-
-
+
+
+
+
Figure 17: CA Certificate Updated
+ +- Click on the **Site Certificate** Choose File box to open a File dialog window and choose your .pem formatted site key and hit Open - the name of the file will appear in the Site Certificate Text Box + +
+
+
+
Figure 18: Choose Site Certificate
+ +
+
+
+
Figure 19: Select Site Certificate File
+ +
+
+
+
Figure 20: Site Certificate Updated
- Select **Import** -
-
-- A modal window saying "Checking Certificates Please Wait... Circle"
- will appear while the files are being loaded.
-
-
-
-- A message underneath the Certificate Import form Text Fields will
- appear saying "Certificate Import Successful!" if the certs are
- accepted.
-
-
+
+
+
+
Figure 21: Import Certificates
+ +- A modal window saying "Checking Certificates Please Wait... Circle" will appear while the files are being loaded. + +
+
+
+
Figure 22: Certificate Import Process
+ +- A message underneath the Certificate Import form Text Fields will appear saying "Certificate Import Successful!" if the certs are accepted. + +
+
+
+
Figure 23: Successful Certificate Import Notification
Notes: @@ -161,13 +315,18 @@ Notes: - CRT Common Name matching NGINX\_HOST variable value -- If invalid certificate files are loaded, an error will appear saying - **Error in Cert Response** in the top right of the window +- If invalid certificate files are loaded, an error will appear saying **Error in Cert Response** in the top right of the window -
+
+
+
+
Figure 24: Invalid Certificate Notification
-#### Notifications +##### Notifications Notifications are automatically generated at login for the following: @@ -177,96 +336,138 @@ Notifications are automatically generated at login for the following: - Milestone Dates coming due or overdue -#### Users +##### Users -The **User** functions allow an administrator to add local User or -Administrator accounts and change passwords. +The **User** functions allow an administrator to add local User or Administrator accounts and change passwords. -
+
+
+
+
Figure 25: Administration - Users Functions
-##### Adding a local Account +###### Adding a local Account To add a local account, select **Add Users** -
+
+
+
+
Figure 26: Add Users
+ +This will bring up the **Add User** dialog Box. Complete the relevant data, to include **First Name**, **Last Name**, **Email Address** (username), set a unique password, and change the time zone. Select the **Role** from the drop-down menu. You have the option between **Admin** or **User**. Once you have finished, click the **Save** button to create the user. + +
+
+
+
Figure 27: Add User Dialog Box
+ +###### Change User Password + +To change a user’s password. Select the 3 buttons to the far right of the user account and select Edit. + +
+
+
+
Figure 28: Change User Password – Edit Account
+ +The **Edit User** dialog box will appear on the right side of the screen. Enter a value for **New Password** and **Confirm Password** and click **Save**. + +
+
+
+
Figure 29: Change Password – Edit User Dialog Box
+ +##### Logs + +Centralized logging can be configured from the **Logs** function within the Administration tab. -This will bring up the **Add User** dialog Box. Complete the relevant -data, to include **First Name**, **Last Name**, **Email Address** -(username), set a unique password, and change the time zone. - -
-
-##### Change User Password
-
-To change a user’s password. Select the 3 buttons to the far right of
-the user account and select Edit.
-
-
+To setup logging, select **Logs** from the **Administration** tab menu.
-The **Edit User** dialog box will appear on the right side of the
-screen. Enter a value for **New Password** and **Confirm Password** and
-click **Save**.
+
+
+
+
Figure 30: Log Configuration
-
+There are three sections on the logging page: **Console**, **File**, and **Syslog**. The **Console** section will adjust which level of logs get outputed to the console on the host machine. The **File** section, will control which application logs are being saved off onto the system. The **Syslog** section will be used to configure the forwarding of your logs to a central location for storage and analysis.
-##### Unlock Account
+Once properly configured click **Save**.
-Unlock account feature is not currently available.
+###### Console
-#### Logs
+- **Log Level** controls which type of logs are sent to the console. There are eight different log levels to choose from (listed below). The higher level logs are inherited into all of the lower level logs. For example; if **Debug** selected, you will received logs from all eight of the log levels. If **Critical (crit)** is selected, you will receive logs from Emergency (emerg), Alert, and Critical (crit). The default setting of **Warning** should meet all required logging for SP 800-53 based authorizations.
-Centralized logging can be configured from the **Logs** function within
-the Administration tab.
+ 1. Emergency (emerg)
+ 2. Alert
+ 3. Critical (crit)
+ 4. Error
+ 5. Warning
+ 6. Notice
+ 7. Info
+ 8. Debug
-To setup logging, select **Logs** from the **Administration** tab menu.
+###### File
-
+- **Enabled** can be toggled on/off to enable and disable logging to files.
+- **Log Level** determines which logs will be saved to files. See **Log Level** in the **Console** section (above) for details on the log levels.
+- **Path** is the directory to which the logs will be stored.
+- **Max File Size (MB)** is an adjustable setting to define the max size, in megabytes, of each log file being created.
+- **Days to Retain** is the amount of time you wish to keep the TIR logs before they are allowed to be deleted on the system
+- **Zip Archive** is a toggle option that (when enabled) will zip your log files into an archive.
-- **PATH** is the local logging path.
+###### Syslog
- **Syslog Target** is the centralized log server, like Splunk.
+- **Syslog Port** is the port being used to forward logs.
+- **Log Level** determines which logs will be forwarded to the centralized log server.
-- **Port** is the port being used to forward logs
-
-- **Log Level** determines which logs will be forwarded to the
- centralized log server. The default setting of **Warning** should
- meet all required logging for SP 800-53 based authorizations.
+### Libraries
-- Once properly configured select **Save**
+The **Libraries** tab provides the ability to import new STIG libraries and updated Control Correlation Identifiers (CCI) mappings for different NIST SP 800-53 revisions.
-## Libraries
+#### STIG Libraries
-The **Libraries** tab provides the ability to import new STIG libraries
-and updated Control Correlation Identifiers (CCI) mappings for different
-NIST SP 800-53 revisions.
+The Department of Defense (DoD) releases quarterly updates to the STIG benchmarks. These quarterly updates are released as .zip files. Once downloaded, the .zip files can be uploaded to TIR and made available to all users.
-1. **STIG Libraries**
+##### View STIG Libraries
-The Department of Defense (DoD) releases quarterly updates to the STIG
-benchmarks. These quarterly updates are released as .zip files. Once
-downloaded, the .zip files can be uploaded to TIR and made available to
-all users.
+Please navigate to the **Libraries** tab by clicking the **Libraries** button at the top on the page.
-#### View STIG Libraries
+Note: The **Libraries** tab will display all of the STIG libraries that have been uploaded to your TIR instance.
-Please navigate to the **Libraries** tab by clicking the **Libraries**
-button at the top on the page.
+
+
+
+
Figure 31: STIG Libraries
-Note: The **Libraries** tab will display all of the STIG libraries that -have been uploaded to your TIR instance. - -
-
-Once imported, the STIG libraries will follow a standardized naming
-convention. The naming convention will follow this template:
-**U\_SRG-STIG\_Library\_{year}\_{month}{revision}.zip**.
+Once imported, the STIG libraries will follow a standardized naming convention. The naming convention will follow this template: **U\_SRG-STIG\_Library\_{year}\_{month}{revision}.zip**.
Please refer to the table below for more examples.
@@ -313,102 +514,27 @@ Please refer to the table below for more examples.
+Table 2: STIG Library Naming Conventions
-Table 1: Access Control – User Permissions - -1. **Import STIG Libraries** - -To import a new STIG library, please navigate to the **Libraries** page -and click the **Import** button inside the **STIG Libraries** section, -as seen in Figure 14. For reference, this button can be found in the top -right of *Figur*e 14: STIG Libraries. - -The **Import** button will open a file navigation window. Please -navigate to the .zip file containing the STIG Library and click -**Open**. - -1. **CCI Matrix** - -CCI mappings are provided by NIST and updated as necessary. CCI mappings -different between SP 800-53 Rev 4 and Rev 5. Keeping this updated ensure -more granular mapping of STIGs to applicable CCIs. - -
-
-#### Import CCI Matrix Updates
-
-To import a new CCI Matrix, please navigate to the Libraries page and
-click the **Import** button inside the CCI Matrix section. For
-reference, this button can be found in the top right of Figure 6: CCI
-Matrix.
-
-1. **Changing Boundary and/or Company Permissions**
-
- 1. **Modify Company Permissions**
-
-To modify Company permissions select the 3 buttons to the far right of
-the Company and select Manage Users.
-
-
-
-- Then the Members dialog box comes up, enter the username in the
- **Search Users** box.
-
-
-
-- The Search Users box should provide a list of similar usernames.
- Select the user account you wish to add.
-
-- Once selected click the down arrow next to Co-Owner and select the
- level of permission you wish to grant.
-
-
-
-- Once the level of access you wish to grant is selected, Click **Add
- Member**
-
-- You will see the account added to the user permissions list for the
- applicable company.
-
-
-
-Member access can be edited or removed from this view as well.
-
-1. **Modify Boundary Permissions**
-
-To modify Boundary permissions select the 3 buttons to the far right of
-the Company and select Manage Users.
-
-
-
-- Then the Members dialog box comes up, enter the username in the
- **Search Users** box.
-
-
+#### Import STIG Libraries
-- The Search Users box should provide a list of similar usernames.
- Select the user account you wish to add.
+To import a new STIG library, please navigate to the **Libraries** page and click the **Import** button inside the **STIG Libraries** section, as seen in Figure 14. For reference, this button can be found in the top right of *Figur*e 14: STIG Libraries.
-- Once selected click the down arrow next to Co-Owner and select the
- level of permission you wish to grant.
+The **Import** button will open a file navigation window. Please navigate to the .zip file containing the STIG Library and click **Open**.
-
+#### CCI Matrix
-Once the level of access you wish to grant is selected, Click **Add
-Member**
+CCI mappings are provided by NIST and updated as necessary. CCI mappings different between SP 800-53 Rev 4 and Rev 5. Keeping this updated ensure more granular mapping of STIGs to applicable CCIs.
-You will see the account added to the user permissions list for the
-applicable company.
+
+
+
+
Figure 32: CCI Matrix
-
+##### Import CCI Matrix Updates
-Member access can be edited or removed from this view as well.
+To import a new CCI Matrix, please navigate to the Libraries page and click the **Import** button inside the CCI Matrix section. For reference, this button can be found in the top right of Figure 32: CCI Matrix.
\ No newline at end of file
diff --git a/src/tir_deployment_guide.docx b/src/tir_deployment_guide.docx
new file mode 100644
index 0000000..7040682
Binary files /dev/null and b/src/tir_deployment_guide.docx differ
diff --git a/src/tir_deployment_guide.md b/src/tir_deployment_guide.md
new file mode 100644
index 0000000..a5918d8
--- /dev/null
+++ b/src/tir_deployment_guide.md
@@ -0,0 +1,341 @@
+# Test Ingest Repository (TIR) Deployment Procedures
+
+
+## Purpose
+
+The purpose of this document is to provide a guide for the deployment of Test Ingest Repository (TIR). TIR is a MITRE Security Assessment Framework (SAF) tool that is used to support boundary and software compliance and continuous monitoring.
+
+## TIR Deployment Using Docker-Compose
+
+1. On the target host system, create a target deployment folder (i.e. /opt/tir).
+
+$ mkdir /opt/tir
+
+
+
+1. Copy over the latest bootstrap script from the pipeline job artifacts. This script is built in the pre-deploy stage of the current TIR gitlab pipeline and can be found in the “Prepare docker-compose” job artifacts (i.e. 
+
+1. At the end of the setup, the bootstrap script will display a massage
+ stating which files had been created based on the selections in the
+ prompts. Note the next steps listed at the bottom.
+
+
+
+1. *If the server is using a private yum repository*, copy the
+ following into the target deployment's nginx\_renew folder from the
+ matching tir repository’s deployment folder:
+
+ 1. A cachain cert (.pem file) for ca-trust
+
+(For LM instances)
+
+$ curl http://crl.external.lmco.com/trust/pem/combined/Combined\_pem.pem
+\\
+
+-o nginx\_renew/cachain.pem
+
+1. .repo file(s) to be used from where openssl, inotify-tools,
+ procps-ng, psmisc can be installed.
+
+(For LM instances)
+
+$ sed -i "s/#INSERTTOKEN#/$EFOSS\_TOKEN/g" nginx\_renew/efoss.repo && \\
+
+sed -i "s/#INSERTUSERNAME#/$EFOSS\_USER/g" nginx\_renew/efoss.repo
+
+1. A yum.conf file if necessary
+
+
+
+1. Install docker-compose, see
+ https://cctdocs.pages.gitlab.us.lmco.com/ironforge/hosting/deployment/index.html
+ and perform
+
+ 1. Preparation
+
+ 2. docker-compose
+
+ 3. Netavark network\_backend install/config
+
+2. Use docker-compose to bring up the deployment
+
+ 1. From your working directory bring up the environment with
+
+$ docker-compose up -d
+
+
+
+1. To see logs on your compose up use
+
+$ docker-compose logs \# you can add -f to follow
+
+
+
+1. To bring down the deployment, run the following:
+
+$ docker-compose down
+
+1. Remove the volumes created by running
+
+$ podman volume ls \# shows a list of created podman volumes
+
+> $ podman volume rm tir-... \# Only use for volumes created by this
+> docker-compose
+
+
+
+# **Steps for TIR Cert Import and Verification**
+
+1. Click **Administration** tab
+
+
+
+1. Click on the **Configuration** tab
+
+
+
+1. Click on the CA Certificate Choose File box to open a File dialog
+ window and choose your signed x509 formatted .crt file and hit
+ Open - the name of the file will appear in the CA Certificate Text
+ Box
+
+
+
+
+
+1. Note name of .crt file shows up in text field.
+
+
+
+1. Click on the Site Certificate Choose File box to open a File dialog
+ window and choose your pem formatted site key and hit Open - the
+ name of the file will appear in the Site Certificate Text Box
+
+
+
+
+
+
+
+1. Select Import
+
+
+
+A modal window saying "Checking Certificates Please Wait... Circle" will
+appear while the files are being loaded.
+
+
+
+A message underneath the Certificate Import form Text Fields will appear
+saying "Certificate Import Successful!" if the certs are accepted.
+
+
+
+Notes:
+
+- The nginx listener checks imported certificates for:
+
+ - A .pem formatted key file
+
+ - A x509 formatted .crt file
+
+ - Cert files matching modulus
+
+ - CRT Common Name matching NGINX\_HOST variable value
+
+- If invalid cert files are loaded, an error will appear saying "Error
+ in Cert Response" in the top right of the window
+
+
+
+## Demonstrating Certificate Import
+
+1. Perform TIR Deployment using docker-compose steps (above)
+
+2. On the host, in the deployment folder, follow the compose logs
+
+$ docker-compose logs -f
+
+Wait for the database to be migrated/seeded completely and nginx image
+to have all packages installed. You will see messages similar to the
+following – from the tirserver, a lot of migrate messages and then it
+will stop – that means it’s done. If you have a good eye, look for
+**tirserver | { event: 'up', message: 'applied X
+migrations.' }** messages. There will be a number of migrations
+that are applied during this setup phase.
+
+> …
+>
+> tirserver | Executing (default): INSERT INTO "seeder\_meta" ("name")
+> VALUES ($1) RETURNING "name";
+>
+> tirserver | {
+>
+> tirserver | event: 'migrated',
+>
+> tirserver | name: '2023.12.07T05.38.17.TierRoles.ts',
+>
+> tirserver | durationSeconds: 0.011
+>
+> tirserver | }
+>
+> tirserver | { event: 'migrating', name:
+> '2023.12.07T14.27.10.BoundaryRoles.ts' }
+>
+> …
+>
+> tirserver | { event: 'migrating', name:
+> '2024.02.03T01.28.29.Classifications.ts' }
+>
+> tirserver | Executing (default): INSERT INTO "Classifications"
+> ("id","name","abbreviation","creationDate","lastUpdate") VALUES
+> (1,'Unclassified','U','2024-03-13T12:39:50.487+00:00','2024-03-13T12:39:50.487+00:00'),(2,'Controlled
+> Unclassified
+> Information','CUI','2024-03-13T12:39:50.487+00:00','2024-03-13T12:39:50.487+00:00'),(3,'Secret','S','2024-03-13T12:39:50.487+00:00','2024-03-13T12:39:50.487+00:00'),(4,'Top
+> Secret','TS','2024-03-13T12:39:50.487+00:00','2024-03-13T12:39:50.487+00:00');
+>
+> tirserver | Executing (default): SELECT table\_name FROM
+> information\_schema.tables WHERE table\_schema = 'public' AND
+> table\_name = 'seeder\_meta'
+>
+> tirserver | Executing (default): SELECT i.relname AS name,
+> ix.indisprimary AS primary, ix.indisunique AS unique, ix.indkey AS
+> indkey, array\_agg(a.attnum) as column\_indexes, array\_agg(a.attname)
+> AS column\_names, pg\_get\_indexdef(ix.indexrelid) AS definition FROM
+> pg\_class t, pg\_class i, pg\_index ix, pg\_attribute a WHERE t.oid =
+> ix.indrelid AND i.oid = ix.indexrelid AND a.attrelid = t.oid AND
+> t.relkind = 'r' and t.relname = 'seeder\_meta' GROUP BY i.relname,
+> ix.indexrelid, ix.indisprimary, ix.indisunique, ix.indkey ORDER BY
+> i.relname;
+>
+> tirserver | Executing (default): INSERT INTO "seeder\_meta" ("name")
+> VALUES ($1) RETURNING "name";
+>
+> tirserver | {
+>
+> tirserver | event: 'migrated',
+>
+> tirserver | name: '2024.02.03T01.28.29.Classifications.ts',
+>
+> tirserver | durationSeconds: 0.015
+>
+> tirserver | }
+>
+> **tirserver | { event: 'up', message: 'applied 7
+> migrations.' }**
+
+1. Load site in browser using the hostname in .env for NGINX\_HOST. It
+ will be insecure due to its originally Self-signed certs.
+
+- In Chrome, type **“thisisunsafe”**
+
+- in the browser to continue.
+
+
+
+1. Follow the steps in “Steps for TIR Cert Import and Verification”
+ steps 1-3.
+
+2. Load invalid certs and note messages in docker-compose logs
+
+ 1. Load non-formatted invalid certs
+
+ 2. Load non-matching certs
+
+ 3. Load matching but wrong site certs
+
+3. Load correct certs, see responses and messages in logs
+
+Ctrl+C out of docker-compose logs, wait about 15 seconds and run the
+following command to see status of tirserver and nginxproxy (and
+postgresdatabase if applicable). Note uptime for proxy is less than
+other two due to its recent restart.
+
+$ podman ps
+
+
+
+1. Close tab and reopen in browser, note cert error is gone – copy
+ http://hostname from address bar
+
+
+
+1. Paste address into a new tab, and go.
+
+
+
+1. Note site information next to address shows secure connection and
+ Certificate is Valid. Click icon next to web address.
+
+
+
+1. Click on Connection is secure to view site details
+
+
+
+1. Click on Certificate is valid to view Certificate information.
+
+
+
+
diff --git a/src/tir_user_guide.md b/src/tir_user_guide.md
index 76454ad..cc77879 100644
--- a/src/tir_user_guide.md
+++ b/src/tir_user_guide.md
@@ -1,152 +1,126 @@
# Test Ingest Repository (TIR) General User Guide
-# References
+## References
-For documentation related to the deployment and installation of the Test
-Ingest Repository please see the **Test Ingest Repository (TIR)
-Deployment Guide**.
+For documentation related to the deployment and installation of the Test Ingest Repository please see the **Test Ingest Repository (TIR) Deployment Guide**.
-For documentation related to the administration of the Test Ingest
-Repository please see **Test Ingest Repository (TIR) Privileged User
-Guide**.
+For documentation related to the administration of the Test Ingest Repository please see **Test Ingest Repository (TIR) Privileged User Guide**.
-# Purpose
+## Purpose
-The purpose of this document is to provide a guide for General User
-functions for Test Ingest Repository (TIR). This guide is designed for
-authorized Information System Security Officers (ISSO), Information
-System Security Managers (ISSM), and System Administrators responsible
-for maintaining compliance and Continuous Monitoring (ConMon) for
-systems and/or networks, where TIR is deployed.
+The purpose of this document is to provide a guide for General User functions for Test Ingest Repository (TIR). This guide is designed for authorized Information System Security Officers (ISSO), Information System Security Managers (ISSM), and System Administrators responsible for maintaining compliance and Continuous Monitoring (ConMon) for systems and/or networks, where TIR is deployed.
-TIR is a MITRE Security Assessment Framework (SAF) tool, built in
-collaboration with Lockheed Martin, that is used to support boundary
-compliance, software compliance, and continuous monitoring.
+TIR is a MITRE Security Assessment Framework (SAF) tool, built in collaboration with Lockheed Martin, that is used to support boundary compliance, software compliance, and continuous monitoring.
-TIR Users have access to certain features in the software. TIR Users
-have the ability to create new Companies and Boundaries. The user that
-creates a Company or Boundary will be assigned the owner permissions of
-that Company or Boundary by default. For Boundaries and Companies that
-were not created by the user, access will need to be granted by an Admin
-or Owner. This helps maintain required separation of roles and
-responsibilities within TIR.
+TIR Users have access to certain features in the software. TIR Users have the ability to create new Companies and Boundaries. The user that creates a Company or Boundary will be assigned the owner permissions of that Company or Boundary by default. For Boundaries and Companies that were not created by the user, access will need to be granted by an Admin or Owner. This helps maintain required separation of roles and responsibilities within TIR.
-# Getting Started
+## Getting Started
-TIR is a repository that will store and manage your system or network’s
-STIG compliance and Plans of Actions and Milestones (POA&M). Your TIR
-instance should be deployed and configured by your System Administrator,
-and access through a web browser. For information about deploying TIR to
-a new environment please see the Test Ingest Repository (TIR) Deployment
-Guide.
+TIR is a repository that will store and manage your system or network’s STIG compliance and Plans of Actions and Milestones (POA&M). Your TIR instance should be deployed and configured by your System Administrator, and access through a web browser. For information about deploying TIR to a new environment please see the Test Ingest Repository (TIR) Deployment Guide.
-## Request Account Access
+### Request Account Access
-Please follow instructions defined by your program to request an
-account. Administrators have access to create accounts and reset
-passwords.
+Please follow instructions defined by your program to request an account Administrators have access to create accounts and reset passwords.
-## Account Permissions
+### Account Permissions
-TIR has two types of users, Administrators and Users. Administrators
-have access to the **Administration,** **Libraries**, and **Boundary**
-tabs. Users only have access to Libraries and Boundary tabs. TIR is
-setup as a hierarchical system with Companies and Boundaries. Users can
-be granted permissions to be Owners, Reviewers, and Editors for
-Companies and Boundaries. A summary of permissions is show in Table 1,
-below.
+TIR has two types of users, Administrators and Users. Administrators have access to the **Administration,** **Libraries**, and **Boundary** tabs. Users only have access to Libraries and Boundary tabs. TIR is setup as a hierarchical system with Companies and Boundaries. Users can be granted permissions to be Owners, Reviewers, and Editors for Companies and Boundaries. A summary of permissions is show in Table 1, below.
-
+
+
+
+
Table 1: Access Control - User Permissions
-## Login +### Login -Once your account has been created, please navigate to the TIR home -page. Enter your **Username** and P**assword**, then review the **IS -User Agreement** and acknowledge that you have read it by clicking the -check box. Then, click **Sign in**. +Once your account has been created, please navigate to the TIR home page. Enter your **Username** and P**assword**, then review the **IS User Agreement** and acknowledge that you have read it by clicking the check box. Then, click **Sign in**. -
+
+
+
+
Figure 1: Login Page
-# Interfaces +## Interfaces -Upon a successful login, the user will be welcomed into TIR and the -**Dashboard** will be displayed. At the top of the page, you will see -three buttons: **Dashboard**, **Boundaries**, and **Libraries**. In -later sections of this guide, you will find detailed instructions on how -to properly configure and use each of these interfaces. +Upon a successful login, the user will be welcomed into TIR and the **Dashboard** will be displayed. At the top of the page, you will see three buttons: **Dashboard**, **Boundaries**, and **Libraries**. In later sections of this guide, you will find detailed instructions on how to properly configure and use each of these interfaces. -## Dashboard +### Dashboard -The dashboard will show you the most recent changes to your TIR instance -and will display any important upcoming dates that the user should be -aware of. Some examples of displayable content include; recent changes -to Boundaries and the newest Security Technical Implementation Guide -(STIG) libraries imported. +The dashboard will show you the most recent changes to your TIR instance and will display any important upcoming dates that the user should be aware of. Some examples of displayable content include; recent changes to Boundaries and the newest Security Technical Implementation Guide (STIG) libraries imported. -
+
+
+
+
Figure 2: Dashboard
-## Boundaries +### Boundaries -The Boundary tab contains “Companies” and “Boundaries” in a hierarchical -structure to best support multiple programs within a single TIR -instance. Companies will be used to store and organize Boundaries. The -Boundaries will store your Systems and all of the STIG data associated -with those Systems. Permissions can be granted to Companies or -Boundaries and your permissions will be granted based on the Role of -your user account (see Table 1 for user permissions). +The Boundary tab contains “Companies” and “Boundaries” in a hierarchical structure to best support multiple programs within a single TIR instance. Companies will be used to store and organize Boundaries. The Boundaries will store your Systems and all of the STIG and Nessus data associated with those Systems. Permissions can be granted to Companies or Boundaries and your permissions will be granted based on the Role of your user account (see Table 1 for user permissions). -
+
+
+
+
Figure 3: Companies in the Boundary Tab
-
+
+
+
+
Figure 4: Boundaries nested under Companies
-## Libraries +### Libraries -The Libraries tab provides the ability to import new STIG libraries and -updated Control Correlation Identifiers (CCI) mappings for different -NIST SP 800-53 revisions. +The Libraries tab provides the ability to import new STIG libraries and updated Control Correlation Identifiers (CCI) mappings for different NIST SP 800-53 revisions. -### STIG Libraries +#### STIG Libraries -The Department of Defense (DoD) releases quarterly updates to the STIG -benchmarks. STIG Libraries can be downloaded at -[public.cyber.mil](public.cyber.mil). These quarterly updates are -released as .zip files. Once downloaded, the .zip files can be uploaded -to TIR and made available to all users. +The Department of Defense (DoD) releases quarterly updates to the STIG benchmarks. STIG Libraries can be downloaded at [public.cyber.mil](public.cyber.mil). These quarterly updates are released as .zip files. Once downloaded, the .zip files can be uploaded to TIR and made available to all users. -#### View STIG Libraries +##### View STIG Libraries -Navigate to the **Libraries** page by clicking the **Libraries** button -at the top on the page. +Navigate to the **Libraries** page by clicking the **Libraries** button at the top on the page. -The **Libraries** page will display all of the STIG libraries that have -been uploaded to your TIR instance. +The **Libraries** page will display all of the STIG libraries that have been uploaded to your TIR instance. -
+
+
+
+
Figure 5: STIG Libraries
-#### Import STIG Libraries +##### Import STIG Libraries -To import a new STIG library, navigate to the **Libraries** page and -click the **Import** button inside the **STIG Libraries** section. For -reference, this button can be found in the top right of *Figure 5: STIG -Libraries*. +To import a new STIG library, navigate to the **Libraries** page and click the **Import** button inside the **STIG Libraries** section. For reference, this button can be found in the top right of *Figure 5: STIG Libraries*. -The **Import** button will open a file navigation window. Navigate to -the .zip file containing the STIG Library and click **Open**. +The **Import** button will open a file navigation window. Navigate to the .zip file containing the STIG Library and click **Open**. -Once imported, the STIG libraries will follow a standardized naming -convention. The naming convention will follow this template: -**U\_SRG-STIG\_Library\_{year}\_{month}{revision}.zip**. +Once imported, the STIG libraries will follow a standardized naming convention. The naming convention will follow this template: **U\_SRG-STIG\_Library\_{year}\_{month}{revision}.zip**. Please refer to the table below for more examples.Table 2: STIG Library Naming Conventions
+ +#### CCI Matrix + +CCI mappings are distributed by NIST and are updated as necessary. The latest CCI Matrix can be downloaded at the following
+
+
+
Figure 6: CCI Matrix
+ +##### Import CCI Matrix Updates + +To import a new CCI Matrix, navigate to the Libraries page and click the Import button inside the CCI Matrix section. For reference, this button can be found in the top right of *Figure 6: CCI Matrix*. + +### About Page + +The **About Page** will let the user know what version of TIR they are currently accessing as well as the date that the current version was pushed to their environment. -Table 1: Access Control – User Permissions +
+
+
+
Figure 7: About Page
-### CCI Matrix +### User Profile -CCI mappings are distributed by NIST and are updated as necessary. The -latest CCI Matrix can be downloaded at the following -
+
+
+
+
Figure 8: User Profile
-#### Import CCI Matrix Updates +Your **User Profile** will display your **Username**, **Role**, **Hidden Password**, **Time zone**, **API Token**, and **Color Theme**. -To import a new CCI Matrix, navigate to the Libraries page and click the -Import button inside the CCI Matrix section. For reference, this button -can be found in the top right of Figure 6: CCI Matrix. +- To change your password, click the **Change** button located on the right-side of the **Password** row. Enter a **New Password**, **Confirm the Password**, and click **Save**. + +
+
+
+
Figure 9: Change Password
-## About Page +- To update your Time zone, select a new time zone from the drop-down menu and click **Update** button located on the right-side of the **Timezone** row. + +
+
+
+
Figure 10: Time Zones
-The **About Page** will let the user know what version of TIR they are -currently accessing as well as the date that the current version was -pushed to their environment. +- To create an **API Token**, click the **Create** button on the right-side of the **Token** row. Enter a **Token Name** and an **Expiration Data,** then click **Generate**. A pop-up window will appear that contains your **Token Code**. Please save that code before closing the window. A list of your existing tokens can be found in the **Token Table**. Please see *Figure 11* as an example. -
+
+
+
+
Figure 11: Create API Token
-## User Profile +- To change the **Coloring Theme** of TIR, choose **System**, **Light**, or **Dark** from the **Theme** row. The **System** option will use the theme from your client system’s settings. -The User Profile icon looks like a person and is located in the -top-right of the screen. To access your profile, click the **Icon** and -then click **Your Profile** (as seen in Figure 8). If you wish to sign -out, you can find the **Sign Out** button located under **Your -Profile**. +
+
+
+
Figure 12: Light Mode vs Dark Mode
-
+### Notifications
-Your **User Profile** will display your **Username**, **Role**, **Hidden
-Password**, **Time zone**, **API Token**, and **Color Theme**.
+Users will receive notifications about important dates related to their Boundaries and when new STIG Libraries are available. The notification for a new STIG Library will be sent out to all Boundary Owners once a new STIG Library is imported into your TIR instance. These notifications will be displayed by the **Bell** icon in the top-right of the screen (as seen in *Figure 13*). A snippet of each unread notification will be displayed from this view.
-- To change your password, click the **Change** button located on the
- right-side of the **Password** row. Enter a **New Password**,
- **Confirm the Password**, and click **Save**.
+
+
+
+
Figure 13: Notification Bell
-
+To view all of your notifications, press the **View all** button at the bottom of the Notification Bell menu (*Figure 13*). An example of the full notification page can be seen below in *Figure 14*.
-- To update your Time zone, select a new time zone from the drop-down
- menu and click **Update** button located on the right-side of the
- **Timezone** row.
+
+
+
+
Figure 14: Notification Alert Center
-
+## Creating your Work Environment
-- To create an **API Token**, click the **Create** button on the
- right-side of the **Token** row. Enter a **Token Name** and an
- **Expiration Data,** then click **Generate**. A pop-up window will
- appear that contains your **Token Code**. Please save that code
- before closing the window. A list of your existing tokens can be
- found in the **Token Table**. Please see Figure 11 as an example.
+The Test Ingest Repository is designed to a store your boundary composition in a hierarchical format. Before you can begin your cyber assessment, you will need to create the path to store your boundary’s scan data.
-
+All instructions within this section will be explicitly from the **Boundaries** interface.
-- To change the **Coloring Theme** of TIR, choose **System**,
- **Light**, or **Dark** from the **Theme** row. The **System** option
- will use the theme from your client system’s settings.
+### Creating Companies
-
+The **Boundaries** landing page will show you the highest level of your organizational structure.
+
+The structure of your boundaries will depend greatly on where TIR is being hosted. For environments being accessed by a wide range of users, compartmentalization will be important. For smaller environments, the compartmentalization structure will not need to be as extravagant.
-## Notifications
+The owner of each boundary will be responsible for creating their **Boundary** inside of TIR. Before creating a boundary, please strategize on the access control elements of your boundary. When creating a boundary, the user will have the option to add a **Company** or add a **Boundary**. The **Companies** are used as a nesting structure to organize where your boundary is stored. The **Boundaries** will be a container that stores all of the cyber assessment data and will provide a workspace to address any findings. To compare to a traditional directory structure, the **Companies** will act as the higher-level directories and the **Boundaries** will act as the lowest level directory. **Systems** will be added to each boundary, and those **Systems** will be the equivalent to actual files existing in your directories.
-Users will receive notifications about important dates related to their
-Boundaries and when new STIG Libraries are available. The notification
-for a new STIG Library will be sent out to all Boundary Owners once a
-new STIG Library is imported into your TIR instance. These notifications
-will be displayed by the **Bell** icon in the top-right of the screen
-(as seen in Figure 13). A snippet of each unread notification will be
-displayed from this view.
+To better illustrate this comparison to the traditional directory structure, please refer to the *Figure 15: Example Boundary Structures* below.
-
+
+
+
+
Figure 15: Example Boundary Structures
-To view all of your notifications, press the **View all** button at the -bottom of the Notification Bell menu (Figure 13). An example of the full -notification page can be seen below in Figure 14. +With that illustration in mind, let’s get started with creating boundaries inside of TIR. Navigate to the **Boundaries** page by clicking the **Boundaries** button at the top on the page. To create a new company, click the **\[+\] Company** button as shown in Figure 16. -
+
+
+
+
Figure 16: Creating a Company
-# Creating your Work Environment +A side panel will open from the right of the screen. Enter the name of the company into the **Company Name** text field and click **Save**. -The Test Ingest Repository is designed to a store your boundary -composition in a hierarchical format. Before you can begin your cyber -assessment, you will need to create the path to store your boundary’s -scan data. +You should now see an item titled with the name you entered into the **Company Name** field. For demonstration purposes, we’ll use the example from *Figure 15*. We’ll start by creating a company for Lockheed Martin and MITRE, as seen in *Figure 17*. -All instructions within this section will be explicitly from the -**Boundaries** interface. +
+
+
+
Figure 17: Companies Example
-## Creating Companies +Navigate inside of your newly created Company by clicking on the item (ex: Lockheed Martin). Once navigating inside a new Company, you will see the **\[+\] Company** and **\[+\] Boundary** buttons. You have the ability to create as many nested Companies as you see fit. -The **Boundaries** landing page will show you the highest level of your -organizational structure. +There is only one restriction to the Company and Boundary structure. That is; Boundaries can NOT exist at the root level of your **Boundaries** tab. A boundary must be placed inside of a Company. Aside from the root level, Boundaries and Company can exist at the same level and Companies can be created to nest Boundaries as much as needed. The role of Companies is limit user access to certain Boundaries. Therefore, when creating your Company and Boundary structures, the users should be organizing their Boundaries in a manner that allows them to control access for their compartmentalized data. -The structure of your boundaries will depend greatly on where TIR is -being hosted. For environments being accessed by a wide range of users, -compartmentalization will be important. For smaller environments, the -compartmentalization structure will not need to be as extravagant. +### Creating a Boundary -The owner of each boundary will be responsible for creating their -**Boundary** inside of TIR. Before creating a boundary, please -strategize on the access control elements of your boundary. When -creating a boundary, the user will have the option to add a **Company** -or add a **Boundary**. The **Companies** are used as a nesting structure -to organize where your boundary is stored. The **Boundaries** will be a -container that stores all of the cyber assessment data and will provide -a workspace to address any findings. To compare to a traditional -directory structure, the **Companies** will act as the higher-level -directories and the **Boundaries** will act as the lowest level -directory. **Systems** will be added to each boundary, and those -**Systems** will be the equivalent to actual files existing in your -directories. - -To better illustrate this comparison to the traditional directory -structure, please refer to the Figure 15: Example Boundary Structures -below. - -
-
-With that illustration in mind, let’s get started with creating
-boundaries inside of TIR. Navigate to the **Boundaries** page by
-clicking the **Boundaries** button at the top on the page. To create a
-new company, click the **\[+\] Company** button as shown in Figure 16.
-
-
-
-A side panel will open from the right of the screen. Enter the name of
-the company into the **Company Name** text field and click **Save**.
-
-You should now see an item titled with the name you entered into the
-**Company Name** field. For demonstration purposes, we’ll use the
-example from Figure 15. We’ll start by creating a company for MITRE 1
-and MITRE 2, as seen in Figure 17.
-
-
-
-Navigate inside of your newly created Company by clicking on the item
-(ex: MITRE1). Once navigating inside a new Company, you will see the
-**\[+\] Company** and **\[+\] Boundary** buttons. You have the ability
-to create as many nested Companies as you see fit.
-
-It is important to note that Boundaries can only exist at the lowest
-level of a company. A company cannot hold both Boundaries and Companies
-at the same level. This means; once you click the **\[+\] Boundary**
-button inside a Company, you will not be able to nest any more
-Companies. This works likewise for when you are nesting Companies. Once
-you click the **\[+\] Company** button, you will not be able to create a
-Boundaries at the level where a Company exists.
-
-## Creating a Boundary
-
-Once you are ready to create a **Boundary**, navigate to an empty
-Company and click the **\[+\] Boundary** button. A side panel will slide
-out from right side of the screen (Figure 18) that will require you to
-fill out a couple fields. Once you have completed all of the fields,
-click the **Save** in the bottom-right of the side panel. See Table 3
-below for more information on the Boundary fields.
+Once you are ready to create a **Boundary**, navigate to an empty Company and click the **\[+\] Boundary** button. A side panel will slide out from right side of the screen (*Figure 18*) that will require you to fill out a couple fields. Once you have completed all of the fields, click the **Save** in the bottom-right of the side panel. See *Table 3* below for more information on the Boundary fields.
Table 3: Boundary Settings
-Figure 1: Login Page +
+
+
+
Figure 18: Creating a Boundary
-
+Your newly created boundary will appear in the table, as shown in *Figure 19: Viewing the list of created Boundaries*. To view your boundary, click on the item in the table.
-Your newly created boundary will appear in the table, as shown in
-*Figure 19: Viewing the list* of created Boundar*y*. To view your
-boundary, click on the item in the table.
+
+
+
+
Figure 19: Viewing the list of created Boundaries
-
+When a Boundary is selected, you will be taken to the Overview sub-tab of the Boundary dashboard. The boundary overview sub-tab will display a high-level overview of your systems and the findings associated with each system.
-When a Boundary is selected, you will be taken to the Overview sub-tab
-of the Boundary dashboard. The boundary overview sub-tab will display a
-high-level overview of your systems and the findings associated with
-each system.
+
+
+
+
Figure 20: Boundary Overview
-
+At the top of the Boundary Overview table you will find the **Path to your Boundary** with breadcrumbs that a linked back to each parent for easy navigation.
-- At the top of the Boundary Overview table you will find the **Path
- to your Boundary** with breadcrumbs that a linked back to each
- parent for easy navigation.
+- The **Number of Systems** field will display the amount of Systems that have been added to your boundary.
-- The **Number of Systems** field will display the amount of Systems
- that have been added to your boundary.
+- The **STIG Findings** fields will display a total number of STIG checks and the unique number of STIG checks. The total number of checks come from the sum of the total checks for each system. The number of unique checks come from the statuses of the checks contained inside the Boundary applied STIGs. For example, if two systems have the same STIG check set to Open, this will count as **two** open findings for the **Total** count but only **one** open finding for the **Unique** count. STIG checklists can be found in the **Boundary View** and **System View**.
-- The **Status** fields will display a total number of STIG checks and
- the unique number of STIG checks. The total number of checks come
- from the sum of the total checks for each system. The number of
- unique checks come from the statuses of the checks contained inside
- the Boundary applied STIGs. For example, if two systems have the
- same STIG check set to Open, this will count as **two** open
- findings for the **Total** count but only **one** open finding for
- the **Unique** count.
+- The **Vuln Findings** fields (similar to STIG Findings) will display a total number of Nessus findings and the unique number of Nessus findings. Nessus findings can be found in the **Vulnerability View**.
-- The **STIG baseline** field will display the STIG Library set for
- this boundary. This STIG baseline can be updated as new STIG
- Libraries become available. To update this field for your boundary:
+- The **NIST version** field will display RMF Framework that was assigned to your boundary.
- 1. Import STIG Libraries
+- The **STIG baseline** field will display the STIG Library set for this boundary. This STIG baseline can be updated as new STIG Libraries become available. To update this field for your boundary, see section **Updating the STIG Baseline for a Boundary** below.
- 2. Navigate to your boundary’s **parent folder**, press the **three
- dots** to the right of your boundary, select **Edit**
+- The **Control Status** fields are for future development.
- 3. Use the drop-down menu for **STIG Baseline** to select the
- newest STIG Baseline
+### Adding Systems to your Boundary
- 4. Click **Save**
+Navigate to the Boundary that you wish to add a system to. Click the **Add System** sub-tab and view the available options.
-- The **NIST version** field will display RMF Framework that was
- assigned to your boundary.
+
+
+
+
Figure 21: Add System Options
-- The **Overlay Selected** and **Control Status** fields are for - future development. - -## Adding Systems to your Boundary - -Navigate to the Boundary that you wish to add a system to. Click the -**Add System** sub-tab and view the available options. - -
-
-There are five options available when adding a system to your boundary:
+There are four options available when adding a system to your boundary:
| Folder(s) |
|
Directory | .Zip Folder | -
| CSV File | -
|
-.Csv File | -
Table 4: System Creation
-Figure 2: Dashboard - -The **Single** and **Widget** options are manual options for creating a -system. The **Folder(s)** and **.Zip Folder** options allow you to -create your boundary using your results from your cyber scans. The final -option for adding systems to your boundary is the **CSV File**. The CSV -File will allow you to pre-build out your boundary by providing a list -of names for each of your systems. - -### Add Single System - -The single system add feature will allow to create a new system inside -of your boundary. When creating a new system, you will be asked to -assign the system a name and click Save. This newly created system will -be blank. For this system to be functional, you will need to add STIG -checklist(s) and/or scan results. - -
-
-### Add System via Widget
-
-The Widget feature is primarily used to duplicate existing Systems
-inside of your boundary. When adding Systems manually, this tool
-eliminates some of the manual steps of creating a new System. You’ll
-have the ability to duplicate as many systems as needed.
-
-The Widget tool is useful when creating systems that mirror already
-existing systems in your boundary. For example, if you have multiple
-workstations that will contain the same STIGs, you can create the system
-and duplicate it for each mirrored workstation in your boundary.
-
-To duplicate a system using the Widget, navigate inside of your
-boundary, click **Add System** and then click **Widget** (as seen in
-Figure 21**)**. A pop-up window will appear (as seen in figure 21).
-Locate the system that you wish to duplicate and click the **Duplicate**
-button on the right side of the row. This will create a new system and
-apply the exact same STIGs that previous system contained. To rename
-this new system, type the new name into the **System Name** field. To
-add additional STIGs, use the **STIGs** field. Finally, to remove any
-STIGs, navigate to the **Applied** STIGs field and click the **X** to
-the left of the STIG.
-
-Once you are satisfied with the new system(s) click the **Create
-Systems** button. For an example of using the widget tool, see Figure
-23.
-
-
-
-### Add Systems by Importing Scan Results via Folder(s)
-
-This method of adding systems will require scan results from each of the
-systems in your boundary. This import function supports CKL and XCCDF
-file formats, and automates the creation of the systems inside of your
-boundary.
-
-There is a standard format that your cyber scan data will need to be
-organized in for this tool to correctly build your boundary. First, a
-parent folder for your boundary needs to be created. Then, navigate
-inside of your boundary folder and create a folder for each system in
-your boundary. Inside of each of these system folders, place all of the
-cyber scan data (.ckl and .xccdf files) associated to that system.
-
-
-
-To create systems by using cyber scan data, navigate inside of your
-boundary, click **Add System** and then click **Folder(s)** (as seen in
-Figure 25**)**. A file navigation window will open which will ask you to
-select a folder. It is very important that you select the parent folder
-that contains individual folders for each system on your boundary. When
-clicking the **Upload** button (inside the file navigation window), you
-should be looking at all of the folders with your system names and the
-parent folder should be displayed in the **Folder** field directly above
-the **Upload** button.
-
-
-
-Once you click the **Upload** button, you will be prompted to confirm
-that you wish to upload all of your results. Click **Upload** on the
-prompt.
-
-
-
-Once all of the files have been uploaded you will be able to view each
-system in the **System View** tab. For more information about the System
-View, please see Section 8.2: System View.
-
-
-
-### Add Systems by Importing Scan Results via .Zip Folder
-
-Users have the option to zip up the results and import the .zip folder
-to create a new system. Each system will need their own .zip folder.
-Please rename the .zip folder to contain the System Name. In our example
-below, **Goat\_DC** is the name of the system that we are creating. The
-**Goat\_DC.zip** folder contains all of our checklist and XCCDF scan
-data. Please note; if you have multiple .zip folders to upload, they
-will need to be uploaded one at a time.
-
-
+The **Single** and **Widget** options are manual options for creating a system. The **Folder(s)** and **.Zip Folder** options allow you to create your boundary using your results from your cyber scans.
-### Add Systems by Importing Scan Results via CSV File
+#### Add Single System
-This feature is planned for a later release.
+The single system add feature will allow to create a new system inside of your boundary. When creating a new system, you will be asked to assign the system a name and click Save. This newly created system will be blank. For this system to be functional, you will need to add STIG checklist(s) and/or scan results.
-# Changing Boundary and/or Company Permissions
+The remaining fields (Host Name, Host IP Address, Host MAC Address, Host Fully Qualified Domain Name) are important when mapping different types a scan results to this system. Please fill out this information if it is known at the time of creation. Many of the automated scanning tools will populate these fields in your checklists. If you are importing checklists that have these system fields populated, the import function will fill out these fields automatically.
-### Modify Company Permissions
+
+
+
+
Figure 22: Add Single System
-To modify Company permissions select the 3 buttons to the far right of -the Company and select Manage Users. +Once you have finished and click **Save**, you will be able to view your new System by clicking the **System View**. -
+#### Add System via Widget
-- Then the Members dialog box comes up, enter the username in the
- **Search Users** box.
+The Widget feature is primarily used to duplicate existing Systems inside of your boundary. When adding Systems manually, this tool eliminates some of the manual steps of creating a new System. You’ll have the ability to duplicate as many systems as needed.
-
+The Widget tool is useful when creating systems that mirror already existing systems in your boundary. For example, if you have multiple workstations that will contain the same STIGs, you can create the system and duplicate it for each mirrored workstation in your boundary.
-- The Search Users box should provide a list of similar usernames.
- Select the user account you wish to add.
+To duplicate a system using the Widget, navigate inside of your boundary, click **Add System** and then click **Widget** (as seen in *Figure 21*). A pop-up window will appear (as seen in *Figure 23*) with the existing systems of your boundary pre-loaded. Locate the system that you wish to duplicate and click the **Duplicate** button on the right side of the row. This will create a new system and apply the exact same STIGs that previous system contained. To rename this new system, type the new name into the **System Name** field. To add additional STIGs, use the **STIGs** field. Finally, to remove any STIGs, navigate to the **Applied** STIGs field and click the **X** to the left of the STIG.
-- Once selected click the down arrow next to Co-Owner and select the
- level of permission you wish to grant.
+To create a brand new system from the widget, click the **\[+\] System** button. Then, rename the system using the **System Name** field. Add applicable STIGs using the **STIGs** drop-down menu.
-
+Once you are satisfied with the new system(s) click the **Create Systems** button. For an example of using the widget tool, see *Figure 23*.
-- Once the level of access you wish to grant is selected, Click **Add
- Member**
+
+
+
+
Figure 23: Duplicate a System by using the Widget
-- You will see the account added to the user permissions list for the - applicable company. +Once you have finished and click **Create Systems**, you will be able to view your new System by clicking the **System View**. -
+#### Add Systems by Importing Scan Results via Folder(s)
-Member access can be edited or removed from this view as well.
+This method of adding systems will require scan results from each of the systems in your boundary. This import function supports CKL, CKLB, and XCCDF file formats, and automates the creation of the systems inside of your boundary.
-### Modify Boundary Permissions
+There is a standard format that your cyber scan data will need to be organized in for this tool to correctly build your boundary. First, a parent folder for your boundary needs to be created. Then, navigate inside of your boundary folder and create a folder for each system in your boundary. Inside of each of these system folders, place all of the cyber scan data (.ckl, .cklb, and .xccdf files) associated to that system.
-To modify Boundary permissions select the 3 buttons to the far right of
-the Company and select Manage Users.
+
+
+
+
Figure 24: Standardized Organizational Structure for Folder Imports
-
+To create systems by using cyber scan data, navigate inside of your boundary, click **Add System** and then click **Folder(s)** (as seen in *Figure 25*). A file navigation window will open which will ask you to select a folder. It is very important that you select the parent folder that contains individual folders for each system on your boundary. When clicking the **Upload** button (inside the file navigation window), you should be looking at all of the folders with your system names and the parent folder should be displayed in the **Folder** field directly above the **Upload** button.
-- Then the Members dialog box comes up, enter the username in the
- **Search Users** box.
+
+
+
+
Figure 25: Adding Systems via Folder(s)
-
+Once you click the **Upload** button, you will be prompted to confirm that you wish to upload all of your results. Click **Upload** on the prompt.
-The Search Users box should provide a list of similar usernames. Select
-the user account you wish to add.
+
+
+
+
Figure 26: Confirm Upload
-Once selected click the down arrow next to Co-Owner and select the level -of permission you wish to grant. +Once all of the files have been uploaded you will be able to view each system in the **System View** tab. -
+
+
+
+
Figure 27: Verifying Successful Creation of Systems
-Once the level of access you wish to grant is selected, Click **Add -Member** +#### Add Systems by Importing Scan Results via .Zip Folder -You will see the account added to the user permissions list for the -applicable company. +Users have the option to zip up the results and import the .zip folder to create a new system. Each system will need their own .zip folder. Please rename the .zip folder to contain the System Name. In our example below, **Goat\_DC** is the name of the system that we are creating. The **Goat\_DC.zip** folder contains all of our checklist and XCCDF scan data. Please note; if you have multiple .zip folders to upload, they will need to be uploaded one at a time. -
+
+
+
+
Figure 28: Adding System via .Zip Folder
-Member access can be edited or removed from this view as well. +Once all of the files have been uploaded you will be able to view each system in the **System View** tab. For more information about the System View, please see the **System View** section. -# Import Test Data for System +### Manually Adding STIGs to a System -Once your Boundary has been created, you will need to import your test -data into your Boundary. To do this, navigate to your Boundary, click on -the System you wish to upload test data of. +Manually adding STIGs is not necessary if you are able to upload scan results for your system. This feature allows you to grab blank checklists from the STIG Libraries and add them to a system. This could be used for STIG checklists that can not be scanned using automated scanning tools. Before adding STIGs to your systems, be sure that you have the latest STIG Library uploaded. See the **Import STIG Libraries** section for instructions on how to upload the latest STIG Library. -
+To add a blank STIG checklist to a system, navigate to your boundary and click **System View**. Next, select a system from the system view.
-The two buttons found in the screenshot above will be used to upload
-STIGs and Test Data Results to your systems. Follow the steps in the
-sections below for more detailed instructions on uploading test data.
+
+
+
+
Figure 29: Import Scan Data
-## Manually Adding STIGs to a System +The two buttons found in the screenshot above (*Figure 29*) can be used to upload STIGs and Test Data Results to your systems. -Before adding STIGs to your systems, be sure that you have the latest -STIG Library uploaded. See Section 4.3.1.2 for instructions on how to -upload the latest STIG Library. +Once you have the latest STIG Library uploaded, navigate to your System and click the button titled **\[+\] STIG** (as seen in *Figure 29: Import Test Data*). A side panel will appear on the right side of your screen. Use the search bar (highlighted in *Figure 30: Adding STIGs to your System*) to find each STIG that is applicable for you System. Click on the STIG to add it to the **Applied STIGs** section at the bottom of the panel. Once you’ve added all of your STIGs, click the **Save** button at the very bottom of the panel. + +
+
+
+
Figure 30: Adding STIGs to your System
+ +Once the STIGs have been added, you will see them displayed in list of STIGs for you system. See *Figure 31* below for an example. + +
+
+
+
Figure 31: Example of STIG Import Completion
+ +## Importing Scan Data + +Once your Boundary and systems have been created, you will be able to import test data into your Boundary. If you have existing scan data in your boundary and are importing new scan results, the new scan results will overwrite the existing data. To do this, navigate to your Boundary and click the **Import Results** button. + +
+
+
+
Figure 32: Import Scan Data
+ +You have three options when importing test data: **Import Folder**, **Import ZIP Folder**, and **Multiple File Selection**. See the below sections for more instructions on those import functions. All of these import functions can import checklists, XCCDF, and Nessus data. TIR identifies what type of scan data you are importing (based on the file type), maps it to the corresponding systems, and displays the information in the proper view. + +### Import Results via Folder(s) + +To use this import function, you first need to organize you scan data in a standard organization structure. Please create a folder for each of your systems and place all of the scan data for each system into their system folder. This will make it easy for TIR to map the scan data to the correct systems. If you choose not to organize your data in this way, you will have to manually assign the scan data files to your systems. To begin importing scan data via folders, click the **Import Results** button in your boundary and select **Folder(s)** from the menu. + +This will launch a file navigation window. Navigate to the folder that contains your test data. If you are importing scan data for every system in your boundary, then navigate to the parent folder that contains your system folders (as seen in the *Figure 33*) and click **Upload**. If prompted to confirm your upload, click **Upload** (as seen in *Figure 26*). + +
+
+
+
Figure 33: Import Results via Folder
+ +If you wish to import test results for a just one of your systems, navigate inside that system folder that contains your test data and click **Upload**. The actual files will not be visible in this file navigation window because it is filtering for folders only. So, please verify that the scan data is present in a separate window (as seen in *Figure 34*). + +
+
+
+
Figure 34: Import Results via Folder - Single System
-Once you have the latest STIG Library uploaded, navigate to your System -and click the button titled **\[+\] STIG** (as seen in Figure 37: Upload -Test Data to your System). A side panel will appear on the right side of -your screen. Use the search bar (highlighted in Figure 38: Adding STIGs -to your System) to find each STIG that is applicable for you System. -Click on the STIG to add it to the **Applied STIGs** section at the -bottom of the panel. Once you’ve added all of your STIGs, click the -**Save** button at the very bottom of the panel. - -
-
-Once the STIGs have been added, you will see them displayed in the
-Boundary page. See Figure 39 below for an example.
-
-
-
-## Adding Checklists and XCCDF Results Data to a System
-
-To add results data, navigate to you System and click the **\[+\]
-Results** button (as seen in Figure 37). You will have three options
-when importing test data: **Import Folder**, **Import ZIP Folder**, and
-**Multiple File Selection**. See the below sections for more
-instructions on those import functions. All of these import functions
-can import checklist and XCCDF data. You do NOT need to upload the blank
-STIG benchmarks to your system prior to importing results.
-The import results functions will add the checklists to the existing
-System.
-
-### Import Results via Folder
-
-To use this import function, please place all of your test data for your
-System into a single folder. Next, navigate to your System, click the
-**\[+\] Results** button then click **Import Folder**. This will launch
-a file navigation window. Navigate to the folder that contains your test
-data and click **Upload**. The actual files will not be visible in the
-file navigation window so please verify that the result data is present
-in a separate window (as seen in Figure 40).
-
-
-
-Notice that we only uploaded four STIG benchmarks in Section 7.1 but we
-uploaded results of nine different STIG checklists. All nine checklists
-will be uploaded to your System, as seen below in Figure 41.
-
-
+If you are prompted to confirm that you wish to upload your files, click **Upload** on the prompt (as seen in *Figure 26*).
### Import Results via Zip Folder
-To use this import function, please place all of your test data for your
-System into a single .zip folder. Next, navigate to your System, click
-the **\[+\] Results** button then click **Import ZIP Folder**. A file
-navigation window will be displayed. Navigate to the .zip folder that
-contains your test data for your system, then press **Open**.
+The **.Zip Folder** import is used to upload the test data for a single system. To use this import function, please zip the scan data for your system. The .zip folder should be titled [System Name].zip (where [System Name] is replaced by the actual System Name). To begin importing scan data via .zip folder, click the **Import Results** button in your boundary and select **.Zip Folder** from the menu.
-
+A file navigation window will be displayed. Navigate to the .zip folder that contains your test data for your system, then press **Open**.
-Upon a successful upload of test data, the test data will be displayed
-inside your System (identical to Figure 41).
+
+
+
+
Figure 35: Import Results via Zip Folder
### Import Results via Multiple File Selection -To use this import function, please place all of your test data for your -System into a single .zip folder. Next, navigate to your System, click -the **\[+\] Results** button then click **Multiple File Selection**. A -file navigation window will be displayed. Navigate to your checklist -and/or XCCDF data and select each file that you would like to upload and -click **Open**. - -
-
-Upon a successful upload of test data, the test data will be displayed
-inside your System (identical to Figure 41).
-
-# POA&M Management
-
-TIR is a repository to store and manage your test artifacts. TIR
-provides a **Boundary View** and a **System View** to manage your data.
-The **Boundary View** allows you to view each STIG as a superset of the
-boundary. Meaning; from a single STIG check view, you will be able to
-view and edit the status of each system that contains that check. The
-**System View** will show you the list of systems inside your boundary
-and will allow you to view all checks related to that individual system.
+With the Multiple File Selection, users are able to select specific scan data files and upload them into your boundary. The file types can include .ckl, .cklb, .Nessus, or .zip files. This import function can be used to upload specific checklist or Nessus data if it is re-scanned or updated. Since we are uploading individual files, these files will need to be mapped to a system manually. To begin importing scan data via multiple file selection, click the **Import Results** button in your boundary and select **Multiple File Selection** from the menu.
+
+A file navigation window will be displayed. Navigate to the file(s) that you wish to upload, then press **Open**.
+
+
+
+
+
Figure 36: Import Results via Selecting Files
+ +A second window will be displayed to allow you to map the scan data to the systems in your boundary. This window contains an expandable and collapsible section. Click the entire row to expand the section. For each file being imported, please select the system from the drop-down menu that will receive these updates. In the example below (*Figure 37*), we are only uploading one file. + +
+
+
+
Figure 37: Assigning a System to Each Imported File
+ +## Delta STIGs + +TIR has the ability to show you which STIG checks have been added or updated when newer STIG Libraries are imported. Users have the option to select the STIG baseline that they want to use for each boundary. When a boundary is moves from older baseline to a newer baseline, there might be some applicable STIG checks that have been added or modified. The following section will show you how to update your STIG baseline and identify the deltas. + +### Updating the STIG Baseline for a Boundary + +1. Import STIG Libraries (see **Import STIG Libaries** section) +2. Navigate to your boundary’s **parent folder**, press the **three dots** to the right of your boundary, select **Edit** +3. Use the drop-down menu for **STIG Baseline** to select the newest STIG Baseline +4. Click **Save** + +
+
+
+
Figure 38: Updating STIG Baseline
+ +### Viewing Deltas + +STIG Checks that have been added or modified will receive a status of **Not Reviewed**. To view the statuses, click on the boundary that you just upgraded to a newer STIG baseline. By default, the Boundary View will be selected and you will be able to view the unique findings for your boundary. In the figure below, all of my STIG checks have been reviewed and assigned a status. Meaning, there are no STIG checks with a status of **Not Reviewed**. This can be verified in *Figure X* by looking at the **Finding Status** column and seeing that the Not Reviewed counts (yellow number) are showing zero. + +
+
+
+
Figure 39: Statuses before STIG Baseline Upgrade
+ +After upgrading the STIG baseline from **U_SRG-STIG-Library_2023_07v1** to **U_SRG-STIG-Library_2024_02v1** we can see that the boundary view is showing STIG checks with statuses of Not Reviewed for three of the STIGs in our boundary: +- Microsoft DotNet Framework 4.0 Security Technical Implementation Guide +- Microsoft Internet Explorer 11 Security Technical Implementation Guide +- Google Chrome Current Windows Security Technical Implementation Guide + +See *Figure 40* below. + +
+
+
+
Figure 40: Statuses after STIG Baseline Upgrade
+ +This means that those three STIGs received updates in the **U_SRG-STIG-Library_2024_02v1** STIG Library release. We can see that the **Date** column for those three STIGs were updated to **24 Jan 2024**, which is when that STIG Library was released. Now, I would be able to go check all of my STIG checks with a Not Reviewed status and evaluate those new/updated items for my boundary. + +## Changing Company and Boundary Permissions + +To add or modify Company and Boundary permissions, select the 3 buttons to the far right of the Company or Boundary and select Manage Members. + +
+
+
+
Figure 41: Modify Company/Boundary Permissions
+ +### Adding Users + +Clicking the **Manage Members** will display the Members dialog box, enter the username in the **Search Users** box. + +
+
+
+
Figure 42: Adding Members – Search Users
+ +The Search Users box should provide a list of similar usernames. Select the user account you wish to add. Once selected click the down arrow next to Co-Owner and select the level of permission you wish to grant. + +
+
+
+
Figure 43: Manage Members – Choose level of Access
+ +Once the level of access you wish to grant is selected, click **Add Member**. You will see the account added to the user permissions list for the applicable company/boundary. + +
+
+
+
Figure 44: Member Access – User Added with Co-owner Role
+ +Member access can be edited or removed from this view as well. This process is the same for both Companies and Boundaries. + +### Editing User Permissions + +Clicking the **Manage Members** will display the Members dialog box. Click the **Edit** button next to the user you wish change permissions for. + +
+
+
+
Figure 45: Edit User Permissions
+ +This will enable the drop-down menu for the role field. To change the user's role, select the new role and click the **Save** button for that user. There is one limitation when editing roles, and that is that each boundary needs to have an Owner. If you are changing the role of user from Owner to Editor, you will first need to assign another user the Owner role. + +
+
+
+
Figure 46: Edit User Role
+ +To remove a user, click the **Remove** button for that user. Owners can not be removed. If you wish to remove an owner from a Company or Boundary you must first grant another user the Owner role. + +
+
+
+
Figure 47: Remove User
+ +## Boundary View + +The **Boundary View** allows you to view each STIG as a superset of the boundary. You will be able to target specific STIG checks and check the status of all the systems that contain that check. From the **Boundary View** you will be able to change the status and severity of STIG checks, however, you will not be able to edit the **Finding Details** and **Comments** for each individual system. To edit either one of those fields for a specific system, you will need to navigate to the **System View**. + +Once you click the **Boundary View** tab, you will see a unique list of all the STIG checklists that have been added to systems in your boundary (as seen below in *Figure 48*). + +
+
+
+
Figure 48: Boundary View
+ +To view the STIG checks inside each of these STIG checklists, simply click on the STIG. For this example, we will be looking at the **Microsoft Edge Security Technical Implementation Guide**. + +Once you open the STIG View, you will see a variety of information related to the Boundary, STIG Library, and STIG Check. Each item is labeled below in *Figure 49*. + +
+
+
+
Figure 49: STIG View Data Key
+ +On the left side of the screen, you will see a section titled **Filters** that contain four status types: **Open**, **NotAFinding**, **Not\_Applicable**, and **Not\_Reviewed**. Each one of the status types can be toggled on and off to display the STIG checks with that status. When filters are selected, they will be colorized. For example, *Figure 50* is filtering so that only STIG checks with a status of **Open** (red) or **Not\_Reviewed** (yellow) will be displayed. + +
+
+
+
Figure 50: Filtering by Status
+ +In *Figure 51* you will see that the **Finding Details** and **Comment** fields pull the data for this check from each system in your boundary. We can see that this check is pulling data from four separate systems in our boundary: **Goat\_DC**, **Goat\_WS2**, **Goat\_WS3**, and **Goat\_WS1**. + +
+
+
+
Figure 51: Finding Details and Comments inside of the Boundary View
+ +To view the status of each one of those systems, you will need to click the **Systems** button (highlighted in *Figure 52*). + +
+
+
+
Figure 52: Systems Button
+ +A pop-up window will appear that displays all of the systems where this STIG check applies and the current status for each system. + +
+
+
+
Figure 53: System Status in the Boundary View
+ +From the Boundary View you will be able to update statuses, severities, and apply overrides for as many systems as you need. For more information about this feature see the **System Statuses and Severities with Overrides** section. + +Additionally, from within the Boundary View, you have the ability to fill out the POAM fields for each STIG finding and track those findings until completion. For more information about these features see the **POA&M Fields** section (under **POA&M Management**). -The access these views, navigate to your Boundary and click the -**Boundary View** or **System View** (as seen in Figure 41). - -
-
-**Figure 41: Boundary and System Views**
-
-## 8.1 Boundary View
-
-As mentioned in the summary under Section 8, the **Boundary View**
-allows you to view each STIG as a superset of the boundary. You will be
-able to target specific STIG checks and check the status of all the
-systems that contain that check. From the **Boundary View** you will be
-able to change the status of STIG checks, however, you will not be able
-to edit the **Finding Details** and **Comments** for each individual
-system. To edit either one of those fields for a specific system, you
-will need to navigate to the **System View**.
-
-Once you click the **Boundary View** tab, you will see a unique list of
-all the STIG checklists that have been added to systems in your boundary
-(as seen below in Figure 42).
-
-
+## System View
-**Figure 42: Boundary View Tab**
+The **System View** tab shows you a list of all the systems inside your boundary, the number of STIGs applied to each system, and the total status counts for all of the checks applied to that system.
-To view the STIG checks inside each of these STIG checklists, simply
-click on the STIG. For this example, we will be looking at the
-**Microsoft Edge Security Technical Implementation Guide**.
+
+
+
+
Figure 54: System View Tab
-Once you open the STIG View, you will see a variety of information -related to the Boundary, STIG Library, and STIG Check. Each item is -labeled below in Figure 43. +To view and edit the data pertaining to one of these systems, click on the system. The next page will show you the list of STIGs that apply to that system. This page will provide versions, dates, and statuses for each STIG. Click on one of the STIGs to open the **STIG View**. -
+
+
+
+
Figure 55: System View STIG List
-**Figure 43: STIG View Data Key** +This **STIG View** page will provide a variety of information related to the System, STIG Library, and STIG Check. These items are also available in the **Boundary View** and have been labeled in *Figure 49*. Additionally, like the **Boundary View**, you have the ability to filter STIG check based on their status (see *Figure 50*). -On the left side of the screen, you will see a section titled -**Filters** that contain four status types: **Open**, **NotAFinding**, -**Not\_Applicable**, and **Not\_Reviewed**. Each one of the status types -can be toggled on and off to display the STIG checks with that status. -When filters are selected, they will be colorized. For example, Figure -44 is filtering so that only STIG checks with a status of **Open** (red) -or **Not\_Reviewed** (yellow) will be displayed. +Unlike the **Boundary View**, the **System View** allows you to edit the **Finding Details** and **Comments** fields. To update the status or severity of each STIG check, use the **Severity** and **Finding Status** drop-down menus in the upper-right (seen in *Figure 56*). -
+
+
+
+
Figure 56: Changing the Status and Severity from the System View
+ +## Vulnerability View -**Figure 44: Filtering by Status** +The Vulnerability View will display all of the Nessus data for you Boundary. From here, you will be able to change the status and severity of Nessus findings. Once you click the **Vulnerability View** tab, you will see a unique list of all the Nessus findings in your boundary. -### System Statuses and Overrides +The first column in the table is the **Vulnerability Name**. This field will display the name of the Nessus check. The next column, **CVE**, will list out all of the CVEs associated to this Nessus finding. The **Nessus Plugin** column will provide the plugin ID for the Nessus plugin that contains this check. Next, the **Severity** column will provide the severity status for each Nessus check. The **Risk Score** columnn provides a risk score (from 0-10) of this finding. Lastly, the **Affected Systems** column will tell you how many systems in your boundary have that Nessus finding. -In Figure 45 you will see that the **Finding Details** and **Comment** -fields pull the data for this check from each system in your boundary. -We can see that this check is pulling data from four separate systems in -our boundary: **Goat\_DC**, **Goat\_WS2**, **Goat\_WS3**, and -**Goat\_WS1**. +
+
+
+
Figure 57: Vulnerability View
-
+To display more information about any of the Nessus findings, simply click on the finding. This will load a new page with details about the finding. These details include a Severity, Risk Score, Vulnerability Description, Synopsis, Solution, CVEs, and Plugin Output.
-**Figure 45: Finding Details and Comments inside of the Boundary View**
+
+
+
+
Figure 58: Vulnerability View Detailed Findinging
-To view the status of each one of those systems, you will need to click -the **Systems** button (highlighted in Figure 46). +From the Vulnerability View you will be able to update statuses, severities, and apply overrides for as many systems as you need. For more information about this feature see the **System Statuses and Severities with Overrides** section. + +Additionally, from within the Vulnerability View, you have the ability to fill out the POA&M fields for each STIG finding and track those findings until completion. For more information about these features see the **POA&M Fields** section (under **POA&M Management**). -
+## System Statuses and Severities with Overrides
-**Figure 46: Systems Button**
+The **System** button is available in the **Boundary View** and **Vulnerability View**. From this view you will be able to update the status and severities of each system in your boundary. Additionally, you have the ability to apply overrides for each of these updates. Override rules can be set on findings so that the status you assign to a finding will persist on the selected systems when new test data is imported in the future. This override feature should be used almost exclusively to set statuses of **Not Applicable** for checks that are deemed **Not Applicable** to your boundary. Using this feature to get an override status of **NotAFinding** could cause you to miss a potential open finding in the future if security settings or Group Policy Objects (GPOs) are disabled or removed.
-A pop-up window will appear that displays all of the systems where this
-STIG check applies and the current status for each system.
+### Updating Statuses with Overrides
+
+To view the status of each of your systems, you will need to click the **Systems** button (highlighted in *Figure 52*). A pop-up window will appear that displays all of the systems where this finding applies and the current status for each system.
+
+
+
+
+
Figure 59: Updating Statuses for Systems
-
+To make an update to a system; select the **checkbox** next to that system, change the status field using the drop-down menu, then click **Save**.
+
+If you want to change the status of multiple systems at once, select the **checkbox** next to each system that you are changing. The **Filters** drop-down in the upper left will allow you to select multiple systems with the single click of a button. Once the desired systems are checked, select the new status from the **Select Status** drop-down (at the top of the middle column) and click the **Set** button directly next to that drop-down menu.
+
+The lock button next to each status is for **Overrides**. To apply an override, check the boxes for each system that you wish to override. Select the status that you wish to set from the drop-down menu. Then, click the **Lock** button directly next to that drop-down menu for each check that you are overriding. Once the **Lock** button is set to the locked state, this status will be overriden each time new scan results are imported. Lastly, provide an Override Justification in the text box to the right of the stautses.
+
+Once all of your changes have been made, click the **Save** button in the bottom-right corner of the pop-up window.
-**Figure 47: System Status and Overrides**
+
+
+
+
Figure 60: Applying Status Overrides
+ +Once an override has been applied, an icon will be displayed next to the check that signifies that there is a override. See *Figure 61* for an example of the override icon. + +
+
+
+
Figure 61: Override Icon
-To make an update to a system; select the **checkbox** next to that -system, change the **Current** status field using the drop-down menu, -then click **Save**. +### Updating Severities with Overrides + +Updating severities works identically like the status updates. To update the severity of a finding, click the **Systems** button, then click the **Severity** tab on the pop-up menu. Select the checkboxes next to each system the you are changing, then update the severity in the drop-down menu for each system. If you want to apply the same severity change to multiple systems, you can check the boxes for the systems you are updating and set the status in the **Select Severity** (at the top of the table) and click **Set**. This will apply the severity to each system that is checked. + +
+
+
+
Figure 62: Updating Severities
-If you want to change the status of multiple systems at once, select the -**checkbox** next to each system that you are changing. The **Filters** -drop-down in the upper left will allow you to select multiple systems -with the single click of a button. Once the desired systems are checked, -select the new status from the **Set Finding Status** drop-down (at the -top of the middle column) and click the **Set** button directly next to -that drop-down menu. +To apply a severity override, select the severity that you wish to set from the drop-down menu. Then, click the **Lock** button directly next to that drop-down menu for each check that you are overriding. Once the **Lock** button is set to the locked state, this severity will be overriden each time new scan results are imported. Lastly, provide an Override Justification in the text box to the right of the stautses. + +
+
+
+
Figure 63: Severity Overrides
-The third column is for **Overrides**. Override rules can be set on a -STIG check so that the status you assign to this check persists on the -selected systems when new test data is imported in the future. This -override feature should be used almost exclusively to set statuses of -**Not Applicable** for checks that are deemed **Not Applicable** to your -boundary. Using this feature to set an override status of -**NotAFinding** could cause you to miss a potential open finding in the -future if security settings or Group Policy Objects (GPOs) are disabled -or removed. To apply an override, select the **checkbox** next to each -targeted system, select the override status from the **Set Override -Status** drop-down menu, then click the **Set** button directly next to -that drop-down menu. +Once all of your changes have been made, click the **Save** button in the bottom-right corner of the pop-up window. -Once all of your changes have been made, click the **Save** button in -the bottom-right corner of the pop-up window. +## Exports -\[Add screenshot show the asterisk to overrides\] +Once you have uploaded all of the test data on for your boundary, you have the ability to export your data into a **Plan of Action and Milestones (POA&M)**, a **Findings Worksheet**, or a **Checklist**. To export your data, navigate to your Boundary and click the **Export Data** button (as seen in *Figure 64*). + +
+
+
+
Figure 64: Export Data
-### POAM Fields +A popup window will appear, please use the tabs at the top of the popup window to specify the output type (POA&M, Findings, Checklist, STIG Security Assessment, Nessus). -From the **Boundary View**, each STIG check will have collapsible and -expandable section titled **POAM Fields**. The user will have the -ability to provide additional comments, program information, milestones, -adjust risk levels, and more. These fields need to be filled out for -each **Open** finding in your boundary. All of this data will be pulled -directly into the POAM export. +### Plan of Action and Milestones (POA&M) + +To export a POA&M; navigate to your Boundary, click the **Export Data** button, click the **POAM** tab, then click **Download POAM**. -After you’ve completed filling out the **POAM Fields** for you STIG -check, click the **Save** button at the bottom of the page. +
+
+
+
Figure 65: Export POA&M
-
+The POA&M will organize all of the findings data for each security control that is not being met.
-**Figure 48: POAM Fields**
+
+
+
+
Figure 66: POA&M Export
+ +### Findings + +To export your data into a **Findings Worksheet**; navigate to your Boundary, click the **Export Data** button, and click the **Findings** tab. The Findings Worksheet allows you to export data based on their finding status. Check the box next to each of finding status’ that you want to export. Then press the **Download** Findings button. For this example, we will export only the **Open** findings for our Boundary. + +
+
+
+
Figure 67: Exporting Findings Spreadsheet
+ +A file will be downloaded to your computer titled **Findings \*.xlsx**. This findings worksheet will display every finding with the statuses that you specified in the previous step. + +The findings worksheet will create an item for each Vulnerability/Finding inside of your Boundary and list all of the Systems Affected by that vulnerability. + +
+
+
+
Figure 68: Findings Export
+ +### Checklists + +TIR provides a couple options for exporting checklists. The default option exports separate checklists for each STIG in a folder with the name of the system. The default format for checklist export is .ckl. If you wish to export in .cklb format, selct the **Checklist Version 3 (.cklb)** checkbox. The other option is to create a single checklist, containing all STIGs, for each system. To export a single checklist for each system, select the **Single STIG per Checklist** checkbox before clicking **Download Checklist**. + +For the default option, select **Export Data**, select the **Checklist tab**, and click **Download Checklist.** + +
+
+
+
Figure 69: Exporting Checklists
-## System View +The output should look like the following: -The **System View** tab shows you a list of all the systems inside your -boundary, the number of STIGs applied to each system, and the total -status counts for all of the checks applied to that system. +
+
+
+
Figure 70: Checklist Export – Folders
+ +
+
+
+
Figure 71: Checklist Export - Files
+ +For a single checklist per system, select the **Single STIG per checklist** box. + +
+
+
+
Figure 72: Checklist Export - Single STIG per Checklist
-
+The output is as follows:
-**Figure 49: System View Tab**
+
+
+
+
Figure 73: Exporting Checklists - Single STIG per Checklist - Folders
-To view and edit the data pertaining to one of these systems, click on -the system. The next page will show you the list of STIGs that apply to -that system. This page will provide versions, dates, and statuses for -each STIG. Click on one of the STIGs to open the **STIG View**. +
+
+
+
Figure 74: Exporting Checklists - Single STIG per Checklist - Files
-
+### STIG Security Assessment
-**Figure 50: System View STIG List**
+The STIG Security Assessment (SSA) is a spreadsheet that provides passing and failing grades for CCI and Control Compliance. This spreadsheet will export all of the STIG checks in your boundary and map the STIG checks to the corresponding CCI and Control. If there are STIG checks with an Open status, then the corresponding CCI and Control will show a Failing status.
-This **STIG View** page will provide a variety of information related to
-the System, STIG Library, and STIG Check. These items are also available
-in the **Boundary View** and have been labeled in Figure 43.
-Additionally, like the **Boundary View**, you have the ability to filter
-STIG check based on their status (see Figure 44).
+To export a SSA, navigate to your Boundary and click Export Data. Next, click the STIG Security Assessment Tab and then **Download**. This will download a the SSA spreadsheet to your local machine.
-Unlike the **Boundary View**, the **System View** allows you to edit the
-**Finding Details** and **Comments** fields. To update the status of
-each STIG check, use the status drop-down menu in the upper-right (seen
-in Figure 51).
+
+
+
+
Figure 75: SSA Export
-
+The first tab in the SSA is the **CCI Compliance** tab. The first column, CCI, will list each applicable CCI for your boundary. This column is followed by a **CCI Description**. The **Control** column will display control(s) associated with that CCI. The **Check** column will show which STIG Checklists, with the rule IDs, that have checks that are mapped to that control. The **CCI Compliance Status** will show a pass or fail grade. The **Finding Status** will show the status of each STIG check that is mapped to the CCI. If your CCI has a failing grade, you will see the STIG Check(s) that have a Open status in the **Finding Status** column.
-**Figure 51: Changing the Status from the System View**
+For an example, see *Figure 76* below.
-# Exports
+
+
+
+
Figure 76: SSA - CCI Compliance Tab
-Once you have uploaded all of the test data on for your boundary, you -have the ability to export your data into a **Plan of Action and -Milestones (POA&M)**, a **Findings Worksheet**, or a **Checklist**. To -export your data, navigate to your Boundary and click the **Export -Data** button (as seen in Figure 44). +The next tab in the SSA is the **Control Compliance** tab. This tab organizes the data based by the Control and gives a passing or failing grade for each control. The first column, **Control** will list out each control applicable to your boundary. The **Control Description**, **Control Text**, and **Supplemental Guidance** columns will be blank for now. This data will be exported once the developement of Control Overlays is completed for TIR. The **Pass/Fail** column will display a passing or failing grade for the control. If any of CCIs for that control are failing then that control will receive a fail grade. The **CCIs** comlumn will list out all of the CCIs associated with each control and show you which CCIs are passing and which are failing. -
+For an example, see *Figure 77* below.
-A popup window will appear, please use the tabs at the top of the popup
-window to specify the output type (POAM, Findings, Checklist).
+
+
+
+
Figure 77: SSA - Control Compliance Tab
-
+The remaining tabs in your SSA will give you detailed information about each STIG in your boundary. This tab starts with the **CCI** column, and lists out each CCI the is applicable for the STIG Checklist you are viewing. The **CCI Description** column will give you a brief description for what the CCI is validating. The **Control** column will list the control associated to the CCI. In the example below we are viewing an Application Security and Development STIG checklist. So, the next column will display the name of the STIG. In this case, **Application Security and Development Security Technical Implementation Guide Check**. This field will display the check text for all of the STIG checks associated to the CCI. Likewise, the next tab will display the fix action text for all of the STIG checks associated to the CCI. In this case, the column reads **Application Security and Development Security Technical Implementation Guide Fix Action**. The **CCI Compliance Status** column will give a passing and failing grade for each CCI. Lastly, the **Finding Status** will list out the V-Key for each STIG check associated to the CCI and provide the status for those checks. If any STIG checks are Open then the CCI Compliance Status will be set to Fail. If none of the STIG checks are open but you still have checks set to Not Reviewed, then the CCI Compliance Status will be left blank until those Not Reviewed checks are addressed.
-## Plan of Action and Milestones (POA&M)
+For an example, see *Figure 78* below.
-To export a POA&M; navigate to your Boundary, click the **Export Data**
-button, click the **POAM** tab, then click **Download POAM**.
+
+
+
+
Figure 78: SSA - STIG Tabs
-The POA&M will organize all of the findings data for each security -control that is not being met. +### Nessus -
+This section is not finished. Need the Nessus csv export to be completed.
-## Findings
+
+
+
+
Figure X: Nessus Export
-To export your data into a **Findings Worksheet**; navigate to your -Boundary, click the **Export Data** button, and click the **Findings** -tab. The Findings Worksheet allows you to export data based on their -finding status. Check the box next to each of finding status’ that you -want to export. Then press the **Download** Findings button. For this -example, we will export only the **Open** findings for our Boundary. -
+## POA&M Management
-A file will be downloaded to your computer titled **Findings \*.xlsx**.
-This findings worksheet will display every finding with the statuses
-that you specified in the previous step.
+The Plan of Action and Milestones (POA&M) export will compile all your scan data along with the addition information you have provided about each open finding and organize it into a spreadsheet. The purpose of a POA&M is to document all of the security findings for your boundary and explain them in terms of the Risk Management Framework (RMF). The POA&M provides details of each finding and the risk associated with the finding. Additionally, the POA&M provides a method to explain why these findings exist and a path forward to addressing the findings (if possible). To fully cover all items on a POA&M, each finding needs to be addressed individually.
-The findings worksheet will create an item for each
-Vulnerability/Finding inside of your Boundary and list all of the
-Systems Affected by that vulnerability.
+TIR allows users to view your findings from the **Boundary View** and **Vulnerability View** where users can address all of the systems that are affected by each finding. There is a built-in workflow with TIR that allows users to document the plan of action needed to address findings as they are discovered. This workflow includes a Milestone schedule that notifies all of the users belonging to your boundary that there is action needed to address certain findings. Milestones are assigned due dates which trigger notifications to each user when due dates are approaching.
-
+When new scan results discover findings, action can be taken immediately. For findings that have existed on your systems for a period of time, the full history of this finding can be referenced and analyzed. These workflow items are all found in the **POA&M Fields** sections of the **Boundary View** and **Vulnerability View**.
-## Checklists
+### POAM Fields
-TIR provides two options for exporting checklists. The default option
-exports separate checklists for each STIG in a folder with the name of
-the system. The second option creates a single checklist, containing all
-STIGs, in a folder with the name of the system.
+From the **Boundary View** and **Vulnerability View**, each check will have a collapsible and expandable section titled **POAM Fields**. The user will have the ability to provide additional comments, program information, milestones, adjust risk levels, and more. These fields need to be filled out for each **Open** finding in your boundary. All of this data will be pulled directly into the POAM export.
-For the default option, select **Export Data**, select the **Checklist
-tab**, and click **Download Checklist.**
+After you’ve completed filling out the **POAM Fields** for an open finding, click the **Save** button at the bottom of the page.
-
+
+
+
+
Figure 79: POA&M Fields
-The output should look like the following: +As you continue to import more test results into your boundary during future scanning events, these POA&M fields will persist. As open items are worked, new milestones can be added and worked through your processes. -
+## Backup and Restore
-
+User will have the ability to backup their entire boundaries. These backups will include all of the STIG Data, Nessus Data, POA&M Fields, Overrides, and much more. The backups are all-encompassing and are exported into a **.json** format.
-For a single checklist per system, select the **Single STIG per
-checklist** box.
+To backup the data for a boundary, you will first need to navigate inside the boundary. Click the gear icon in the top-right side of the boundary overview page. Then, click **Boundary Export**.
-
+
+
+
+
Figure X: Boundary Export
-The output is as follows: +The restore feature can be used to recover lost data inside TIR or transfer your boundary data from one TIR instance to another TIR instance. -
+To restore the data for a boundary, you will first need to navigate inside the boundary. If the boundary does not exist in your TIR instance, you will need to create a new boundary to store this data. From the boundary overview page, click the gear icon in the top-right and then click **Boundary Import**.
-
+
+
+
+
Figure X: Boundary Import
\ No newline at end of file