diff --git a/oval-schemas/panos-definitions-schema.xsd b/oval-schemas/panos-definitions-schema.xsd new file mode 100644 index 0000000..1396555 --- /dev/null +++ b/oval-schemas/panos-definitions-schema.xsd @@ -0,0 +1,171 @@ + + + + + + The following is a description of the elements, types, and attributes that compose the Palo Alto (PAN-OS)-specific + tests found in Open Vulnerability and Assessment Language (OVAL). Each test is an extension + of the standard test element defined in the Core Definition Schema. Through extension, each test inherits a + set of elements and attributes that are shared amongst all OVAL tests. Each test is described in detail and + should provide the information necessary to understand what each element and attribute represents. This document + is intended for developers and assumes some familiarity with XML. A high level description of the interaction + between the different tests and their relationship to the Core Definition Schema is not outlined here. + + + This schema was originally developed by William Munyan at cisecurity.org. The OVAL Schema is maintained by the + OVAL Community. For more information, including how to get involved in the project and how to submit change + requests, please visit the OVAL website at http://oval.cisecurity.org. + + + Palo Alto (PAN-OS) Definitions + 5.11.2:2.0 + 03/30/2021 09:00:00 AM + + For the portion subject to the copyright in the United States: Copyright (c) 2016 United States Government. + All rights reserved. Copyright (c) 2016, Center for Internet Security. All rights reserved. The contents of + this file are subject to the terms of the OVAL License located at https://oval.cisecurity.org/terms. See the + OVAL License for the specific language governing permissions and limitations for use of this schema. When + distributing copies of the OVAL Schema, this license header must be included. + + + + + + + + + + + + + + The config_test is used to check the properties of the XML output from a PAN-OS XML API request to export the + current running configuration. This is a request to the API at "https://[PAN-OS-DEVICE]/api/?type=export&category=configuration". + The response to this request is an XML payload rooted with a "response" element and including device-specific information. + It extends the standard TestType as defined in the oval-definitions-schema and one should refer to the TestType + description for more information. The required object element references a config_object and the optional state + element specifies the data to check. + + + + config_test + config_object + config_state + config_item + + + + + + - the object child element of a config_test must reference a config_object + + + - the state child element of a config_test must reference a config_state + + + + + + + + + + + + + + + + + + + The config_object element is used by a config_test to define the object to be evaluated. Each object extends the + standard ObjectType as defined in the oval-definitions-schema and one should refer to the ObjectType description + for more information. The common set element allows complex objects to be created using filters and set logic. + Again, please refer to the description of the set element in the oval-definitions-schema. + + + A config_object consists of an xpath entity that contains an XPATH 1.0 query to perform on the PAN-OS API response + XML data. The response data is assumed to consist of a <response> entity, with arbitrary (i.e., vendor-specific) + child nodes. + + + + + + + + + + + State referenced in filter for '' is of the wrong type. + + + + + + + + + + + + + + + Specifies an Xpath expression describing the text node(s) or attribute(s) to look at. Any valid + XPath 1.0 statement is usable with one exception, at most one field may be identified in the XPath. + This is because the value_of element in the data section is only designed to work against a single + field. The only valid operator for xpath is equals since there is an infinite number of possible + XPaths and determinining all those that do not equal a given XPath would be impossible. + + + + + - operation attribute for the xpath entity of a config_object should be 'equals', note that this overrules the general operation attribute validation (i.e. follow this one) + + + + + + + + + + + + + + + + + The config_state element defines the different information that can be used to evaluate the result of a specific + config XPath evaluation. This includes the XPath used and the value of this XPath. + + + + + + + + + Specifies an XPath expression describing the text node(s) or attribute(s) to look at. + + + + + The value_of element checks the value(s) of the text node(s) or attribute(s) found. + + + + + + + + diff --git a/oval-schemas/panos-system-characteristics-schema.xsd b/oval-schemas/panos-system-characteristics-schema.xsd new file mode 100644 index 0000000..9285032 --- /dev/null +++ b/oval-schemas/panos-system-characteristics-schema.xsd @@ -0,0 +1,66 @@ + + + + + + This document outlines the items of the OVAL System Characteristics XML schema that are composed of Palo Alto-specific + tests. Each item is an extention of a basic System Characteristics item defined in the core System Characteristics XML + schema. + + + This schema was originally developed by William Munyan at cisecurity.org. The OVAL Schema is maintained by the OVAL + Community. For more information, including how to get involved in the project and how to submit change requests, please + visit the OVAL website at http://oval.cisecurity.org. + + + Palo Alto (PAN-OS) Definitions + 5.11.2:2.0 + 03/30/2021 09:00:00 AM + + For the portion subject to the copyright in the United States: Copyright (c) 2016 United States Government. + All rights reserved. Copyright (c) 2016, Center for Internet Security. All rights reserved. The contents of + this file are subject to the terms of the OVAL License located at https://oval.cisecurity.org/terms. See the + OVAL License for the specific language governing permissions and limitations for use of this schema. When + distributing copies of the OVAL Schema, this license header must be included. + + + + + + + + + + + + + This item stores results from checking the contents of an XML configuration. + + + + + + + + Specifies an XPath expression describing the text node(s) or attribute(s) which were collected. + + + + + + The value_of element checks the value(s) of the text node(s) or attribute(s) found. How this + is used is entirely controlled by operator attributes. + + + + + + + + +