Adding Policy Checks API

InsightVM
1

Hello All,

Looking through the API documentation I cannot find a way to edit our policies through the API. The only things it seems it allows me to do is pull information with the GET command. Please let me know if it is possible to edit our policies with the API.

Thanks,
Jacob

2

The API does not support editing/creating new policies :slightly_frowning_face:. I’m not sure if we have any plans to add those capabilities in the future, but I’ll definitely pass that along internally.

3

One thing that I’ll add though, if you’re using custom policies you may be able to modify the policy XML locally to configure it to suit your needs. You can export the policy XML from the policy editor in InsightVM and could then upload it with the edits.
image

4

@tyler_schmidtke

Hi Tyler,

We are sort of experiencing issues downloading the xml files we created for a custom policy. Below is the error we are experiencing. Any suggestions? We are trying to add L2 checks to a custom policy based off of L1. The L1 does not have a sub category that we need to add from the L2 checks. We need to add 8.5 sub category to a policy that has the category 8 but not 8.5. If you need any more detail happy to share.
image

Thanks again,

Jacob

5

@jacob_horning, could you post the full file name? I wonder it’s being generated on our end in a way that is valid for *nix systems but not for Windows.

6

Sure thing.

xccdf_org.cisecurity.benchmarks_benchmark_1.0.0_CIS_VMware_ESXi_6.5_Benchmark_1604939354680:1.0.0:xccdf_org.cisecurity.benchmarks_profile_Level_1-datastream.xml

7

Yup, the colons are the issue: https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file?redirectedfrom=MSDN

Could you try renaming it to not include colons?

8

It could also be a issue with the Maximum Path Length: https://docs.microsoft.com/en-us/windows/win32/fileio/maximum-file-path-limitation

9

@tyler_schmidtke Thank you again for helping with renaming those files.

When we download custom policies there is only one xml file in the zip folder. When we download existing policies in the zip folder there our 4 total files. We are looking to add a few more categories from the existing policy to our custom policy. Any suggestions?

Thanks again,

Jacob

10

I can’t say that I have any experience with creating/editing them (outside the editor). I just know that they’re XML so they could be programmatically modified. I did some quick digging and found the schema files for the XCCDF format which these policies are in: https://csrc.nist.gov/Projects/Security-Content-Automation-Protocol/Specifications/xccdf#resource-1.1.4

Additionally, it looks like MITRE has some open source tooling that might help with converting them to an easier to work with format and then back to the XCCDF XML: https://inspec-tools.mitre.org/

In particular the xccdf2inspec and inspec2xccdf commands stood out to me. Hope that proves helpful. Sorry that I can’t provide more specific help.