A Peek Inside ConfigOS MPO’s Key Features: Results Templates
Written by Jamie McCoard, SteelCloud Development Manager
I’m going to begin by giving you a chart to help process some of the terms throughout this article (terms used will have color coding in this article to help refer back to this information):
What is MPO’s Results Templates Feature?
The Results Templates feature in MPO is designed to streamline the compliance process by allowing users to override the status of specific controls. These include:
· Controls that require a Manual Review.
· Controls that are initially set to “Not Processed” during policy configuration.
By setting up status overrides on these controls, along with adding comments and findings, users can achieve a more comprehensive view of the total compliance status of a policy for an endpoint.
Why Use MPO’s Results Templates?
Utilizing the Results Templates feature
allows you to improve your compliance percentage for STIG policies beyond what
automation alone can achieve. This feature is particularly useful in the
following scenarios:
- Processed Controls with Expected Failures: When you have waivers or external processes in place that cover the control requirements.
- Manual Review Controls: When you have a process in place to address the check content of these controls.
- Not Processed or Manual Review Controls: When these controls should be set as “Not Applicable.”
By leveraging Results Templates, you can ensure a more
accurate and comprehensive compliance status for your policies.
Usage of MPO’s Results Templates
Consider a real-world scenario where you have a Windows
Server 2019 host and need to adapt the policy to your business needs.
As of the time of this article, DISA is on V3R3 of
the Windows Server 2019 STIG. SteelCloud has released its STIG v10 MPO
policy update file with version V3R3. Within this policy, there
are 18 controls set as requiring manual review. These controls can be configured
to passing status using a documented Results Template.
For example, let’s consider Group ID V-205799:
“Windows Server 2019 audit records must be backed up to a different system
or media than the system being audited.” The validation for this control
is that your organization has a backup process in place.
By using Results Templates, you can document and validate
these processes, ensuring compliance and adapting the policy to meet your
specific business needs.
View from Forge
(Controls are filtered to show only the documentation controls. Notice on the right side that “Requires Manual Review” is checked and there are no automation parts.)
When a scan of the STIG policy is run on a Windows Server 2019 endpoint the outcome of this control will have the status set as Manual Review. Our results show:
· Total Compliance: 31.27%
· Processed Compliance: 41.75%.
The Processed toggle includes the full STIG control list with our 18 manual review controls. By default, the Processed view is shown, but you can switch to the Total view using the toggle.
Since we have a process in place and a waiver setup that confirms we can consistently pass this control for all Windows Server 2019 endpoints, we can use a Results Template to document this.
Creating a Results Template
For a user to be able to create Results Templates the permission for “Can Modify Results Templates” or “Administrator” is required.
You can create a Results Template in three different ways:
- From Settings > Results Templates
- Create from a CKL or CKLB STIG Viewer File: Right-click in the left menu to create from a CKL or CKLB file. The statuses, comments, and finding details will be imported for each control.
- Copy from Another Results Template: Right-click on a template in the left menu to create a copy from another Results Template.
- From Settings > Policy Manager
- Create from a Policy: Right-click on the policy to create a template from that policy.
For this example, we will create a Results Template from the policy:
- Open the Desktop Client application.
- Go to Settings, then Policy Manager.
- Right-click on the Windows Server 2019 STIG policy and select “Create Results Template”.
- A name will be auto-generated—you can modify it as desired.
- Click “Create”.
- You’ll receive a notice in the logs that the Results Template was created.
Editing Results Templates
To switch to the Results Templates section, navigate to Settings.
Tip:
When creating a template from a policy, all statuses are initially set to Not Processed. This means that any existing Manual Review control will be overridden as Not Processed in the results. When a template is applied to a policy, you will no longer see the Manual Review status.
Let’s edit the new Windows Server 2019 STIG Template we created to modify our example control V-205799:
- Select the Template: From the left templates list, select the template.
- Click Edit: Click on the Edit
button on the top bar. - Find the Control: Scroll down until you find control V-205799.
Setting Status Options in Results Templates
In the results template, there are four status options based on the STIG Viewer expected outcome statuses:
Modifying Control V-205799
- Set Status: Set control V-205799 to Passed.
- Modify Details: Update the finding details and comments to document the waiver or process in place.
- Background Color: When a status is set, the control’s row background color will update accordingly.
- Save Changes: Click the Save button to accept the changes.
Tip:
There is a timeout of 10 minutes when editing, so save often when working on the full template list.
Connecting the Results Template to the Policy
To ensure that the new Results Template is connected to the policy for your endpoints, follow these steps:
- Navigate to Group Setup: Go to the Group Setup section.
- Edit Your Group: Select the group you want to edit.
- Click the Pencil Button: Click on the pencil button to the right of your Windows Server 2019 policy under “Associated Result Templates”.
- Select the New Template: Choose the new Results Template from the list.
- Save Changes: Click Save to apply the template to the policy.
Running a Manual Scan
To see our work in action, let’s run a manual scan. The results show:
- Total Compliance: Improved to 32%
- Processed Compliance: Updated to 42.51%
This improvement reflects our overall policy compliance. The V-205799 control is now passing, and our comments are included in the details.
Exporting Endpoint Results
When you export the endpoint’s results as a checklist (CKL/CKLB), it will include our Results Template fields:
- Status
- Comments
- Finding Details
These elements are derived from our Results Template, ensuring that all relevant information is documented and easily accessible.
Conclusion
Our use case for this control is now complete. Results Templates are invaluable in achieving 100% compliance for any STIG policy.
If you have any questions, feel free to comment below or reach out to us to schedule a demo. We can go over this feature and more in detail.
Featured Resources