Guide

How to Use the STIG Hardening Tool

Turn a DISA Manual STIG XCCDF benchmark into a reviewed, customizable script—Bash automation for Linux/macOS, a PowerShell implementation workbook for Windows—with validation checks appended automatically.

Platform Capabilities at a Glance

What You Need

• A DISA Manual STIG XCCDF file (*-Manual-xccdf.xml) or STIG .zip package
• A target host that matches the benchmark (Linux, Mac, or Windows)
• Root/sudo (Linux/macOS) or elevated PowerShell (Windows) on the target
• A lab or staging environment for initial testing

Step 1 — Download the Benchmark from DISA

1. 1 Visit public.cyber.mil/stigs/downloads and select your OS and version.
2. 2 Download the STIG package. ZIP archives are supported—the tool auto-extracts the XCCDF XML inside.
3. 3 Verify checksums if DISA provides them. Using the wrong benchmark version is a common source of breakage.

Step 2 — Upload or Try a Demo

On the home page, either upload your .xml or .zip file, or pick a bundled demo benchmark (Linux, macOS, or Windows demos on the home page) to explore the workflow without a live STIG download.

After a successful parse you will see a summary: total rules, and how many are automated, partial, or manual.

Step 3 — Configure Each Rule

The remediation screen lists every STIG rule with its category, fix type, and DISA description. For each rule, choose:

• Default Fix — use the DISA fixtext converted to script commands (best for automated rules)
• Skip Fix — leave the rule unchanged; useful for rules you will handle manually or defer
• Custom Fix — paste your own reviewed commands when DISA defaults do not fit your environment

Default actions vary by fix type:

• automated / partial → Default Fix
• gpo → Default Fix (structured GPO checklist included in script)
• manual / profile → Skip Fix (narrative or MDM steps)

Use search, filters (including GPO only), and pagination (25/50/100 per page) when working with large benchmarks.

Distribution Notes

Ubuntu (24.04 LTS and similar)

• Download Canonical Ubuntu 24.04 LTS STIG from DISA—look for U_CAN_Ubuntu_24-04_LTS_*_Manual-xccdf.xml inside the ZIP.
• Expect heavy use of apt, ufw, /etc/pam.d/common-*, AppArmor, and pwquality edits.
• Many rules are partial or manual because DISA fixtext describes file edits; the tool echoes instructions and may suggest guarded append lines—review before running.
• Try the bundled Ubuntu 24.04 demo on the home page (188 rules) to explore the workflow before uploading your own download.

Red Hat Enterprise Linux (8 / 9)

• Use the matching U_RHEL_8_STIG_* or U_RHEL_9_STIG_* Manual XCCDF for your major version.
• Larger benchmarks (366–446 rules): use bulk actions and pagination; expect more service restarts and SELinux-related commands.
• Reboot commands from DISA are deferred to a single systemctl reboot after all remediations and validation checks.
• Demo benchmarks for RHEL 8 and RHEL 9 are available on the home page.

Debian (12 and similar)

• Download the Debian STIG for your release from public.cyber.mil/stigs/downloads (filename varies by revision).
• Upload the .zip or *-xccdf.xml directly—there is no bundled Debian demo yet because DISA packages change between revisions.
• Debian STIGs overlap Ubuntu patterns (apt, PAM, sysctl) but paths and package names differ—always match benchmark to installed release.
• After upload, confirm the stats bar (automated / partial / manual counts) before generating a script.

Step 4 — Preview the Script

Click Generate Script to build a single .sh or .ps1 file. The preview shows the full output, including:

• Root check and OS detection
• Remediation commands grouped by rule with comments
• Deferred reboot commands (moved to the end so validation runs first)
• XCCDF check-content validation for each rule
• A PASS / FAIL / MANUAL summary at the end

Read every line before downloading. If you use an AI assistant for review, see our Automation & AI guide for copy-ready prompts.

Step 5 — Download and Run on the Target

Linux / macOS

1. 1 Download remediation.sh and transfer to the target (scp, Ansible, golden image, etc.).
2. 2 Make executable: chmod +x remediation.sh
3. 3 Run as root: sudo ./remediation.sh
4. 4 Review output and log (default /var/log/stig-remediation-*.log).

Windows

1. 1 Download remediation.ps1 and transfer to the target host.
2. 2 Open elevated PowerShell and run: powershell -ExecutionPolicy Bypass -File .\remediation.ps1
3. 3 Use the printed GPO IMPLEMENTATION CHECKLIST sections while configuring policies in gpedit.msc or domain Group Policy.
4. 4 Review transcript log (default under %TEMP%\stig-remediation-*.log).

Understanding Validation Results

At the end of the script, each rule is checked against DISA check-content:

PASS/FAIL auto-scoring applies only to rules where you chose Default Fix on an automated rule. Everything else is flagged MANUAL by design so you do not get a false sense of compliance. This is not a substitute for OpenSCAP, SCC, or an official DISA assessment—treat unexpected FAIL results as a prompt to read the check-content, not as ground truth.

Pre-Flight Safety Checklist

• Benchmark version matches target OS and major version
• Snapshot or backup taken before running on any important system
• Maintenance window scheduled (some rules restart services or defer a reboot)
• Skipped rules documented with an owner and remediation plan
• Script tested in a lab identical or close to production
• Validation FAIL and MANUAL items reviewed before declaring the system compliant

macOS (15 and similar)

• Download Apple macOS STIG Manual zip from DISA (e.g. U_Apple_macOS_15_*_Manual-xccdf.xml).
• Runnable Bash is extracted from prose fixtext; profile rules require configuration profiles (manual/MDM).
• Run with sudo ./remediation.sh. Try the macOS 15 demo on the home page.

Windows (Server 2025, Windows 11)

Known limitations (shortfalls)

• DISA source is GPO prose — most fixtext says “Configure the policy value for Computer Configuration >> …”, not PowerShell. Full auto-hardening is not in the benchmark.
• Very few runnable commands — only fixtext with quoted or line-broken PowerShell becomes executable (e.g. Disable-WindowsOptionalFeature).
• No GPO auto-import — we do not download DISA GPO bundles or map policies to registry keys for LGPO. You configure policies manually.
• Wrong file type — SCAP scanner-only zips (e.g. some *_SCAP_* bundles) are for compliance scanning, not this tool. Use *-Manual-xccdf.xml.
• Manual rules skipped by default — multi-step narrative fixes (AppLocker setup, user rights, etc.) need human implementation.
• Validation stays MANUAL for GPO — PASS/FAIL auto-scoring applies only to automated default fixes. GPO checklist output does not prove compliance.
• SecGuide templates — some policies require copying SecGuide.admx/.adml from the DISA STIG package into PolicyDefinitions before the policy appears in the editor.
• Not a formal assessment — this is not SCC, OpenSCAP, or an official DISA evaluation.

Recommended Windows workflow

1. 1 Upload *-Manual-xccdf.xml or try the Windows 11 / Windows Server 2025 demo.
2. 2 Filter by gpo and review structured checklists in each rule’s Default Fix preview.
3. 3 Generate the script (GPO rules included by default). Run elevated to produce a checklist log.
4. 4 Apply policies in gpedit.msc (standalone) or Group Policy Management (domain). Re-run validation or use your SCAP scanner for formal scoring.

• GPO checklist blocks show: Policy, Path, Set to, optional details, SecGuide/reboot notes.
• Runnable PowerShell lines run as normal commands; checklist lines are safe Write-Host output.