T

ci / audit (push) Successful in 24s

Details

[#389 ] first discovery scan COMPLETE: 21 findings on sectestbed 5104 — GMP scan pipeline committed

GLPI target → Discovery config → OpenVAS scanner → report
c3294575-3db4-4ad1-8e50-3ca6d23fb137 (18 info, 1 low ICMP-timestamp,
2 unscored). VM shut back down. Pipeline scripts in openvas/scan-pipeline/.
https://projects.knownelement.com/issues/389

2026-09-05 16:04:50 -05:00

.crush

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

.gitea/workflows

[#784 ] add fleet CI workflow (shellcheck + secret scan + rule audit)

2026-09-05 06:08:57 -05:00

docker/gvm-test

[#389 ] GVM UI moved to 127.0.0.1:19443 — k3s ingress hostPorts claim 80/443 on this node

2026-09-05 11:29:24 -05:00

openvas

[#389 ] first discovery scan COMPLETE: 21 findings on sectestbed 5104 — GMP scan pipeline committed

2026-09-05 16:04:50 -05:00

scripts

[#389 ] house naming: container_name for all 21 GVM services (ukrrs-oam-gvm-*)

2026-09-05 07:27:05 -05:00

tests

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

.env.example

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

.gitignore

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

AGENTS.md

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

LICENSE

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

Makefile

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

questions-v1.md

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

README.md

[#452 ] wire Discourse topic t/338 into README

2026-09-05 05:27:01 -05:00

STATUS.md

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

README.md

KNEL/compliance — compliance & security body of work

STIG/SCAP, CMMC, vulnerability management, and penetration testing for the KNEL fleet. This repo is PRIVATE — it holds vulnerability data, scan results, and security posture detail.

Goal posture (founder mandate, 2026-09-05): CMMC level 3, highest STIG profile, facility clearance track; assume constant pressure from highly skilled, well-resourced attackers. FedRAMP-style audit readiness.

Systems of record

what	where
Redmine project	compliance-security — umbrella #311
CMMC program	#452 gap analysis to CMMC L3 / facility clearance
Related	#382 STIG/SCAP, #389 OpenVAS/GVM on kali-tsys, #381 CIS hardening, #379 compliance test lab (sectestbed), #804 second approver
Discourse	https://community.turnsys.com/t/338

Layout (seeded 2026-09-05, growth expected)

scap/ — SCAP content pipeline: ComplianceAsCode/content profiles driven through Ansible/AWX (KNELIAC security_scap_stig role), OpenSCAP scanning on sectestbed first, then fleet.
openvas/ — Greenbone/OpenVAS on kali-tsys, inventory-fed from GLPI (#705 CMDB) so scans cover the whole fleet asset list.
cmmc/ — CMMC L3 roadmap, evidence structure, control mapping, reference: Kell Engineering ansible-hardening deployment guide.
bor/ — deploy plan for https://github.com/VuteTech/bor
pentest/ — pentest tooling + AI-assisted testing exploration (MCP-driven frameworks vs bespoke automation over our own stack).

Working agreements

Findings/scan output NEVER leave this repo or Redmine.
Prod pentest activity requires an approved GLPI CR + maintenance window.
sectestbed VMs are the first targets (see KNEL/PFVCluster change-mgmt map).