Import an existing SCAP (XML) Benchmark into Slang in order to create new rules, customize check logic, change the embedded remediation guidance and more!
Follow this guide to:
It should take about 15 minutes. Make sure you’ve completed the Slang QuickStart Guide first so you have general familiarity with Slang files and editing.
slang import <path.to.downloaded.file> Windows10STIG.
~/Slang/Windows10STIGin VS Code (
id_namespace. This should be a valid reverse-DNS style string (letters, numbers, periods, hyphens only) associated with you or your organization. For example, if you worked for acme.com, you could use
V-220748\SV-220748r569187_rule.slang in VS Code and:
The system must be configured to audit Account Logon - Credential Validation successes and failures.
tagsthat aren’t meaningful to you and improve the
Success and Failurewould be acceptable. We’re going to change that!
common.ovalto the end) and start typing
windows.to see a list of suggested checks
[space]to see suggestions, select
credential_validation, and then
success and failure. The checks section should look like this:
checks: - windows.audit_policy.subcategory: credential_validation: success and failure
Auditingcontaining a new file
dpapi_auditing.slangwith the following content:
Rule: title: The system must be configured to audit DPAPI Activity failures. checks: - windows.audit_policy.subcategory: dpapi_activity: failure only
We’re going to remove
V-220924\SV-220924r569187_rule.slang, a Smart-card rule.
The simplest way to remove the rule would be to simply delete the file. Feel free to do that and skip the rest of this section or… leave the file in place and continue this section to remove it via a Slang Profile.
If you aren’t familiar with Slang profiles, take a look at the Slang Profiles Quickstart.
profile.my_company.slangwith the following content:
Profile: title: My Company Profile select_all_rules_except: - SV-220924r569187_rule.slang
slang export Windows10STIG windows.10.stig.xmlto export your Slang project to SCAP (XML).
slang export Windows10STIG windows.10.stig.xml --scan_config TestStig --profile profile.my_company.slangto export and test your project using the profile you created.
DPAPIrule! Filter to “NOT SELECTED” and you should see the “Smart Card” rule we removed.
Congratulations! You have customized a STIG and have an SCAP (XML) file you can run using any standards-compliant assessment engine.
Please contact your account executive or reach out here!