T

ci / audit (push) Successful in 24s

Details

[#389 ] GVM target import: gvm-script (gmp.send_command, lxml parse) + IANA port-list injection; feed jq rewrite (record-bound, no IFS collapse)

63/63 GLPI targets imported into gvmd (0 failures). Admin creds in
~/.creds/gvm-test.env. Import is idempotent (deletes glpi-* first).
https://projects.knownelement.com/issues/389

2026-09-05 11:21:36 -05:00

.crush

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

.gitea/workflows

[#784 ] add fleet CI workflow (shellcheck + secret scan + rule audit)

2026-09-05 06:08:57 -05:00

docker/gvm-test

[#389 ] house naming: container_name for all 21 GVM services (ukrrs-oam-gvm-*)

2026-09-05 07:27:05 -05:00

openvas

[#389 ] GVM target import: gvm-script (gmp.send_command, lxml parse) + IANA port-list injection; feed jq rewrite (record-bound, no IFS collapse)

2026-09-05 11:21:36 -05:00

scripts

[#389 ] house naming: container_name for all 21 GVM services (ukrrs-oam-gvm-*)

2026-09-05 07:27:05 -05:00

tests

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

.env.example

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

.gitignore

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

AGENTS.md

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

LICENSE

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

Makefile

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

questions-v1.md

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

README.md

[#452 ] wire Discourse topic t/338 into README

2026-09-05 05:27:01 -05:00

STATUS.md

[#452 ] seed compliance & security repo (CMMC/STIG/OpenVAS/pentest)

2026-09-05 05:17:33 -05:00

README.md

KNEL/compliance — compliance & security body of work

STIG/SCAP, CMMC, vulnerability management, and penetration testing for the KNEL fleet. This repo is PRIVATE — it holds vulnerability data, scan results, and security posture detail.

Goal posture (founder mandate, 2026-09-05): CMMC level 3, highest STIG profile, facility clearance track; assume constant pressure from highly skilled, well-resourced attackers. FedRAMP-style audit readiness.

Systems of record

what	where
Redmine project	compliance-security — umbrella #311
CMMC program	#452 gap analysis to CMMC L3 / facility clearance
Related	#382 STIG/SCAP, #389 OpenVAS/GVM on kali-tsys, #381 CIS hardening, #379 compliance test lab (sectestbed), #804 second approver
Discourse	https://community.turnsys.com/t/338

Layout (seeded 2026-09-05, growth expected)

scap/ — SCAP content pipeline: ComplianceAsCode/content profiles driven through Ansible/AWX (KNELIAC security_scap_stig role), OpenSCAP scanning on sectestbed first, then fleet.
openvas/ — Greenbone/OpenVAS on kali-tsys, inventory-fed from GLPI (#705 CMDB) so scans cover the whole fleet asset list.
cmmc/ — CMMC L3 roadmap, evidence structure, control mapping, reference: Kell Engineering ansible-hardening deployment guide.
bor/ — deploy plan for https://github.com/VuteTech/bor
pentest/ — pentest tooling + AI-assisted testing exploration (MCP-driven frameworks vs bespoke automation over our own stack).

Working agreements

Findings/scan output NEVER leave this repo or Redmine.
Prod pentest activity requires an approved GLPI CR + maintenance window.
sectestbed VMs are the first targets (see KNEL/PFVCluster change-mgmt map).