Implementation Guide: Automate STIG Compliance Checks, Generate SCAR/SCAP Reports & Trigger Patch Deployment

# Deploy SCC agent and configure automated scanning via PowerShell
# SCC 5.x supports both interactive and command-line operation

# Step 1: Deploy SCC to all endpoints via MECM/Intune software deployment
# SCC Silent Install:
$SCCInstaller = "C:\Installers\SCC-5.x.x_Windows_bundle.exe"
$InstallArgs = "/S /v/qn"
Start-Process -FilePath $SCCInstaller -ArgumentList $InstallArgs -Wait

# Verify installation:
Get-Package -Name "SCAP Compliance Checker*" | Select Name, Version

# Step 2: Stage STIG SCAP content on endpoints
# Download SCAP content from public.cyber.mil for each applicable STIG
# Example: Windows 11 STIG SCAP content
$SCAPContentPath = "C:\SCC\Resources\Content"
$STIGContent = @(
    "U_MS_Windows_11_V2R2_STIG_SCAP_1-3_Benchmark.zip",
    "U_MS_Office_365_ProPlus_V2R12_STIG_SCAP_1-3_Benchmark.zip",
    "U_Google_Chrome_V2R10_STIG_SCAP_1-3_Benchmark.zip"
)
# Deploy SCAP content to each endpoint via MECM software distribution or GPO

# Step 3: Configure SCC command-line automated scan
# Create scan script (run via Azure Automation or Windows Task Scheduler):

$SCCBinary = "C:\Program Files\SCAP Compliance Checker 5\cscc.exe"
$ResultsPath = "C:\SCC\Results\$(Get-Date -Format 'yyyyMMdd')"
New-Item -ItemType Directory -Path $ResultsPath -Force

# Run SCC scan with all applicable SCAP content
$SCCScanArgs = @(
    "--version",
    "--select-all",                    # Scan all installed SCAP content
    "--output-format", "all",          # Output: XCCDF, HTML, CSV, CKL
    "--output-path", $ResultsPath,     # Results directory
    "--log-level", "1"                 # Standard logging
)

$ScanResult = Start-Process -FilePath $SCCBinary `
    -ArgumentList $SCCScanArgs `
    -Wait -PassThru -NoNewWindow

Write-Host "SCC Scan completed. Exit code: $($ScanResult.ExitCode)"
Write-Host "Results saved to: $ResultsPath"

# Step 4: Upload results to central share (Azure Files or SharePoint)
# For Azure Files (Azure Government):
$StorageAccount = "stigresultsprod"
$ShareName = "stig-results"
$AzureFilesPath = "\\${StorageAccount}.file.core.usgovcloudapi.net\${ShareName}"

# Map Azure Files share (using storage account key or Azure AD auth)
net use Z: $AzureFilesPath /user:"Azure\$StorageAccount" $env:STORAGE_ACCOUNT_KEY

# Copy results
Copy-Item -Path "$ResultsPath\*" -Destination "Z:\$env:COMPUTERNAME\$(Get-Date -Format 'yyyyMMdd')\" -Recurse
net use Z: /delete

Write-Host "Results uploaded to central STIG results repository."

# Parses SCC XCCDF results and generates compliance reports

# stig_results_processor.py
# Parses SCC XCCDF results and generates compliance reports

import xml.etree.ElementTree as ET
import json, os, datetime, glob

# XCCDF namespaces used by DISA SCC output
NAMESPACES = {
    'xccdf': 'http://checklists.nist.gov/xccdf/1.2',
    'arf': 'http://scap.nist.gov/schema/asset-reporting-format/1.1',
    'dc': 'http://purl.org/dc/elements/1.1/'
}

def parse_scc_results(xccdf_file: str) -> dict:
    """Parse a DISA SCC XCCDF results file and extract findings."""
    tree = ET.parse(xccdf_file)
    root = tree.getroot()

    results = {
        "scan_date": datetime.datetime.utcnow().isoformat(),
        "hostname": "Unknown",
        "stig_benchmark": "Unknown",
        "findings": [],
        "summary": {
            "open": 0,          # Non-compliant (CAT I, II, III failures)
            "not_a_finding": 0, # Compliant
            "not_applicable": 0,
            "not_reviewed": 0,
            "cat_i": 0,         # Critical (CAT I)
            "cat_ii": 0,        # High (CAT II)
            "cat_iii": 0        # Medium (CAT III)
        }
    }

    # Extract target system info
    target = root.find('.//xccdf:target', NAMESPACES)
    if target is not None:
        results["hostname"] = target.text

    # Extract benchmark info
    benchmark = root.find('.//xccdf:benchmark', NAMESPACES)
    if benchmark is not None:
        results["stig_benchmark"] = benchmark.get('id', 'Unknown')

    # Extract individual rule results
    for rule_result in root.findall('.//xccdf:rule-result', NAMESPACES):
        rule_id = rule_result.get('idref', '')
        result_elem = rule_result.find('xccdf:result', NAMESPACES)
        result_value = result_elem.text if result_elem is not None else 'unknown'

        # Get severity from rule definition
        severity = rule_result.get('severity', 'medium')
        cat = {"high": "CAT I", "medium": "CAT II", "low": "CAT III"}.get(severity, "Unknown")

        # Get finding details
        check_content = rule_result.find('.//xccdf:check-content', NAMESPACES)
        finding = {
            "rule_id": rule_id,
            "result": result_value,
            "severity": severity,
            "category": cat,
            "fix_text": ""  # Populated from STIG benchmark reference
        }

        results["findings"].append(finding)

        # Update summary counts
        if result_value == "fail":
            results["summary"]["open"] += 1
            if cat == "CAT I":
                results["summary"]["cat_i"] += 1
            elif cat == "CAT II":
                results["summary"]["cat_ii"] += 1
            elif cat == "CAT III":
                results["summary"]["cat_iii"] += 1
        elif result_value == "pass":
            results["summary"]["not_a_finding"] += 1
        elif result_value == "notapplicable":
            results["summary"]["not_applicable"] += 1
        elif result_value in ["notchecked", "unknown"]:
            results["summary"]["not_reviewed"] += 1

    results["summary"]["total_rules"] = len(results["findings"])
    results["summary"]["compliance_score"] = round(
        results["summary"]["not_a_finding"] /
        max(results["summary"]["total_rules"] - results["summary"]["not_applicable"], 1) * 100, 1
    )

    return results


def generate_poam_entries(findings: list, system_name: str, isso: str) -> list:
    """Generate POA&M entries from STIG open findings."""
    poam_entries = []

    for finding in findings:
        if finding["result"] == "fail":
            scheduled_completion = (
                datetime.date.today() +
                datetime.timedelta(days=30 if finding["severity"] == "high" else 90)
            ).isoformat()

            poam_entries.append({
                "poam_id": f"POAM-{finding['rule_id'][-6:]}",
                "system": system_name,
                "weakness_name": f"STIG Finding: {finding['rule_id']}",
                "weakness_description": f"{finding['category']} STIG finding — {finding['rule_id']}",
                "point_of_contact": isso,
                "resources_required": "System Administrator — 1-4 hours",
                "scheduled_completion_date": scheduled_completion,
                "milestone_with_completion_date": f"Apply STIG remediation — {scheduled_completion}",
                "status": "Ongoing",
                "comments": "AI-generated entry — ISSO review required before submission to eMASS"
            })

    return poam_entries

# stig_report_generator.py

from openai import AzureOpenAI
import os, json

client = AzureOpenAI(
    azure_endpoint=os.environ["AZURE_OPENAI_ENDPOINT"],
    api_key=os.environ["AZURE_OPENAI_KEY"],
    api_version="2024-08-01-preview"
)

def generate_stig_compliance_narrative(
    scan_results: dict,
    prior_scan_results: dict = None,
    system_name: str = "Unknown System",
    issm_name: str = "ISSM"
) -> str:
    """Generate AI-assisted STIG compliance report narrative."""

    summary = scan_results.get("summary", {})
    trend = ""
    if prior_scan_results:
        prior_open = prior_scan_results.get("summary", {}).get("open", 0)
        current_open = summary.get("open", 0)
        delta = current_open - prior_open
        trend = f"TREND: {abs(delta)} findings {'added' if delta > 0 else 'remediated'} since last scan. "

    report_prompt = f"""Generate a STIG compliance status report narrative for ISSO and leadership review.

SYSTEM: {system_name}
SCAN DATE: {scan_results.get('scan_date', 'Unknown')}
STIG BENCHMARK: {scan_results.get('stig_benchmark', 'Unknown')}
ISSM: {issm_name}

COMPLIANCE SUMMARY:
- Total rules evaluated: {summary.get('total_rules', 0)}
- Compliant (Not a Finding): {summary.get('not_a_finding', 0)}
- Open Findings: {summary.get('open', 0)}
  - CAT I (Critical): {summary.get('cat_i', 0)}
  - CAT II (High): {summary.get('cat_ii', 0)}
  - CAT III (Medium): {summary.get('cat_iii', 0)}
- Not Applicable: {summary.get('not_applicable', 0)}
- Not Reviewed: {summary.get('not_reviewed', 0)}
- Overall Compliance Score: {summary.get('compliance_score', 0)}%
{trend}

Generate:
## EXECUTIVE SUMMARY
- Overall compliance posture assessment (Acceptable / Marginal / Unacceptable)
- Most significant findings requiring immediate attention
- Trend assessment (improving/declining/stable)
- ISSM risk acceptance recommendation for any CAT I findings

## CAT I FINDINGS (CRITICAL — 30-day remediation required)
For each CAT I finding: Rule ID, brief plain-language description, recommended remediation

## TOP CAT II FINDINGS
Top 5 CAT II findings by remediation priority

## RECOMMENDED REMEDIATION PRIORITY ORDER
Ordered list of remediation actions (most critical first)
Each action: What to do, estimated admin effort (hours), risk if not remediated

## POA&M STATUS
Summary of findings that require POA&M entries vs. findings that can be remediated immediately

## CMMC COMPLIANCE IMPACT
Which CMMC practices are affected by the current open findings?
(Reference: CM.L2-3.4.1, CM.L2-3.4.2, SI.L2-3.14.x as applicable)

[DRAFT — AI GENERATED — REQUIRES ISSO REVIEW AND ISSM APPROVAL]
[Classification: CUI — Handle per CMMC requirements]"""

    response = client.chat.completions.create(
        model=os.environ["AZURE_OPENAI_DEPLOYMENT"],
        messages=[
            {"role": "system", "content": "You are a DoD cybersecurity compliance specialist generating STIG compliance reports for ISSO and leadership review. Be precise about finding severity and remediation requirements per DISA standards."},
            {"role": "user", "content": report_prompt}
        ],
        temperature=0.1,
        max_tokens=3000
    )

    return response.choices[0].message.content

# Configure Intune Update Rings via Microsoft Graph API (Government endpoint)
# Connect to Microsoft Graph (Government)
Connect-MgGraph -Environment USGov -Scopes "DeviceManagementConfiguration.ReadWrite.All"

# Create Windows Update Ring for automatic patching
$updateRingParams = @{
    displayName = "CMMC-Endpoints-Update-Ring"
    description = "Automated Windows patching for CMMC boundary endpoints. Maintenance window: Sunday 02:00-06:00 ET"
    microsoftUpdateServiceAllowed = $true
    driversExcluded = $false
    qualityUpdatesDeferralPeriodInDays = 0       # No deferral for security updates
    featureUpdatesDeferralPeriodInDays = 30      # 30-day deferral for feature updates
    automaticUpdateMode = "autoInstallAndRebootAtScheduledTime"
    scheduledInstallDay = "sunday"
    scheduledInstallTime = 2                     # 2 AM
    deadlineForQualityUpdatesInDays = 7          # Force install within 7 days
    deadlineForFeatureUpdatesInDays = 14
    deadlineGracePeriodInDays = 2
    postponeRebootUntilAfterDeadline = $false
    userPauseAccess = "disabled"                 # Users cannot pause updates
    userWindowsUpdateScanAccess = "disabled"     # Users cannot run Windows Update manually
    updateNotificationLevel = "defaultNotifications"
}

# Create the update ring
$updateRing = New-MgDeviceManagementDeviceConfiguration -BodyParameter $updateRingParams
Write-Host "Update ring created: $($updateRing.Id)"

# Assign update ring to CMMC endpoint group
$groupId = (Get-MgGroup -Filter "displayName eq 'CMMC-Boundary-Endpoints'").Id
$assignmentParams = @{
    target = @{
        "@odata.type" = "#microsoft.graph.groupAssignmentTarget"
        groupId = $groupId
    }
}
New-MgDeviceManagementDeviceConfigurationAssignment `
    -DeviceConfigurationId $updateRing.Id `
    -BodyParameter $assignmentParams

Write-Host "Update ring assigned to CMMC-Boundary-Endpoints group."

# Create compliance policy to enforce STIG-aligned configuration
$complianceParams = @{
    displayName = "CMMC-STIG-Compliance-Policy"
    description = "Enforces DISA STIG-aligned configuration baselines for CMMC compliance"
    passwordRequired = $true
    passwordMinimumLength = 15                   # STIG requires 15+ chars
    passwordRequiredType = "alphanumeric"
    passwordMinutesOfInactivityBeforeLock = 15  # STIG: 15 min timeout
    encryptionRequired = $true                   # STIG: BitLocker required
    secureBootEnabled = $true                    # STIG: Secure Boot required
    activeFirewallRequired = $true               # STIG: Windows Firewall on
    antivirusRequired = $true
    antiSpywareRequired = $true
    defenderEnabled = $true
    rtpEnabled = $true                           # Real-time protection
    signatureOutOfDate = $false                  # Require current signatures
    osMinimumVersion = "10.0.22631"             # Windows 11 23H2 minimum
}

$compliancePolicy = New-MgDeviceManagementDeviceCompliancePolicy `
    -BodyParameter $complianceParams
Write-Host "STIG compliance policy created: $($compliancePolicy.Id)"

-- Non-Compliant Devices Alert, Patch Compliance Status, CAT I Finding Age
-- Tracker, and Compliance Score Trend

// Sentinel KQL: STIG Compliance Monitoring
// Data source: Intune compliance data via Sentinel connector

// ─── 1. Non-Compliant Devices Alert ──────────────────────────────────────────
IntuneDeviceComplianceOrg
| where TimeGenerated > ago(24h)
| where ComplianceState == "noncompliant"
| summarize
    noncompliant_count = dcount(DeviceId),
    devices = make_set(DeviceName),
    owners = make_set(UPN)
  by ComplianceState, OS, OSVersion
| where noncompliant_count > 0
| extend Alert = strcat(noncompliant_count, " non-compliant devices detected — STIG compliance failure")
| project TimeGenerated = now(), Alert, noncompliant_count, devices, owners, OS, OSVersion


// ─── 2. Patch Compliance Status ───────────────────────────────────────────────
// Track patch deployment success rate within maintenance window
Update
| where TimeGenerated > ago(7d)
| where UpdateState == "Needed"
| where Classification in ("Security Updates", "Critical Updates")
| summarize
    needed_count = count(),
    oldest_needed = min(TimeGenerated),
    devices_needing_update = make_set(Computer)
  by Title, BulletinID, KBID
| extend days_outstanding = datetime_diff('day', now(), oldest_needed)
| where days_outstanding > 7  // Patches outstanding more than 7 days
| order by days_outstanding desc


// ─── 3. CAT I Finding Age Tracker ─────────────────────────────────────────────
// Custom table populated by STIG results processor (see Step 2)
STIGFindings_CL
| where FindingResult_s == "fail"
| where FindingSeverity_s == "high"  // CAT I
| where FindingStatus_s != "Remediated"
| extend days_open = datetime_diff('day', now(), OpenDate_t)
| where days_open > 30  // CAT I findings require 30-day remediation
| project
    Hostname_s, BenchmarkID_s, RuleID_s,
    days_open, OpenDate_t,
    ISSO_s, SystemName_s
| extend Alert = strcat("CAT I STIG finding overdue: ", RuleID_s, " on ", Hostname_s,
                         " — ", days_open, " days open (30-day limit)")
| order by days_open desc


// ─── 4. Compliance Score Trend ────────────────────────────────────────────────
STIGFindings_CL
| where TimeGenerated > ago(90d)
| summarize
    total = count(),
    compliant = countif(FindingResult_s == "pass"),
    cat_i_open = countif(FindingResult_s == "fail" and FindingSeverity_s == "high")
  by bin(TimeGenerated, 7d), SystemName_s
| extend compliance_pct = round(toreal(compliant) / total * 100, 1)
| project TimeGenerated, SystemName_s, compliance_pct, cat_i_open, total
| order by SystemName_s, TimeGenerated asc