Feature: HTML report refactoring (report by chapter, new design, etc)

[drabaly]

It would be nice to have all the file failing or passing regrouped by CIS chapter so that is it easier to see if a rule is applied in one of many files.

[Mincka]

I agree in this one. I guess this implies update of JSON rules to include "section" or "chapter", and not trying to split the "rule_id".

I think in this case it would be best to keep the order of chapters and the order of control points inside each chapter (not have the valid tests at the end).

Finally, if there is a grouping by chapter, it means it would make sense to have both the name of the chapter and name of the items.

[righettod]

Yes, it can be handled with an additional attribute in the JSON object of an audit rule, as we use objects in the code, normally, this update should not impact the analyzer...

[Mincka]

Quick mockup with a few ideas:

• Section name
• Rule name
• Control point (each regex expression checked)
• Scoring (Scored / Not scored, referenced in the CIS document but not clear how the computation is done)
• Level (specific to IIS?)
• Check result (always shown to highlight the checked regex)
• Pass test is kept ordered (it's possible to keep the current view as a second table so both presentations can be used)

[righettod]

We can add the following attributes (top four) to a rule definition in order to limit the modification on the whole project but reaching the mockup above:

{
        "rule_name": "xxx",
        "section_name": "xxx",
        "Scored": true,
        "Level": 1,
        "rule_id": "CIS-1.1",
        "CIS_version": "IIS-10-1.1.1",
        "audit_expressions": [
            {
                "expression": "Export-DataPoint11=.*('PhysicalPath':'C:)",
                "presence_needed": "False"
            }
        ],
        "override_rules": []
    },

Control point can be dynamically determined via the property self.audit_expressions of the audit_rule object.

Normally only the parsing and reporting will be impacted as well as their unit test suites but when we will work in this ticket it will affect all the type of server related files so it's must be carefully planned.

As I know, Level can be applied to Apache too but it will be a complete hell to hande 👎

[Mincka]

Why Level could not be another attribute with an integer type (1/2)?
As far I can see in the latest documents, it's only a simple attribute of each rule with 2 levels.
It would allow to get an overview for both levels with scoring.

Idea of simple overview:

Level 1
Scored [XXXXXXXXXXXX--------------] 50% (30/60)  Extra points (Not Scored) [XXX-------------------] 25% (4/16)

Level 1 + Level 2
Scored [XXXXX---------------------] 25% (30/120) Extra points (Not Scored) [XXX-------------------] 25% (5/20)

[righettod]

It can 😃

As the JS lib ChartJS is already embedeed then we can use the info to create charts representing the level progress you mentioned.

Example:

• https://www.chartjs.org/samples/latest/charts/radar.html
• https://www.chartjs.org/samples/latest/charts/polar-area.html
• https://www.chartjs.org/samples/latest/charts/bar/horizontal.html

Or a simple HTML progress bar:

• https://www.w3schools.com/tags/tryit.asp?filename=tryhtml5_progress

[Mincka]

Sample
https://jsfiddle.net/0gqew4x9/1/