@mitre/hdf-mappings 3.4.1 → 3.4.3

package/README.md

@@ -20,6 +20,7 @@ and `tags.cci` fields in HDF output.
 | Nikto | NIST SP 800-53 | Test ID string (`'1'`) |
 | ScoutSuite | NIST SP 800-53 | Rule name string |
 | AWS Config | NIST SP 800-53 | Rule identifier or rule name |
+| Hipcheck | NIST SP 800-53 Rev 5 | Analysis name (`binary`, `mitre/binary`) |
 
 Go equivalents are available in `go/` subdirectories (see below).
 
@@ -207,6 +208,55 @@ const nistId2 = getAwsConfigNistControlByName('secretsmanager-scheduled-rotation
 if (awsConfigIdentifierExists('SECRETSMANAGER_SCHEDULED_ROTATION_SUCCESS_CHECK')) { /* ... */ }
 ```
 
+#### Coverage tiers and semantics
+
+The AWS Config→NIST table is regenerated (via `scripts/generate-awsconfig-mappings.mjs`) from
+three tiers, in precedence order:
+
+1. **config-pack** — AWS Config's "Operational Best Practices for NIST 800-53" docs (Rev 4 + Rev 5).
+2. **security-hub** — AWS Security Hub's NIST 800-53 r5 standard control pages (Rev 5).
+3. **derived** — for a managed rule the authoritative tiers miss but whose name matches a strong
+   theme (encryption-at-rest, in-transit/TLS, logging/audit, public-access), the controls that
+   ≥75% of AWS's *own* same-theme mapped rules carry. Nothing is invented — controls are reused
+   from AWS's authoritative mappings. Rules matching no theme stay unmapped, and the
+   `aws-config-to-hdf` converter floors them to **CM-6** (Configuration Settings) at conversion time.
+
+> **Interpretation.** These NIST tags are *candidate control associations for triage*, not evidence
+> that a control is assessed or satisfied. A passed Config / Security Hub rule is evidence *toward*
+> the tagged controls, not proof they are met — one rule rarely satisfies a control in full, and the
+> derived and CM-6 tiers are coarse by design. Do not roll "rule passed" up to "tagged controls
+> satisfied" in SSP / eMASS / ATO exports.
+
+### Hipcheck
+
+Maps MITRE Hipcheck analysis names to NIST 800-53 Rev 5 controls. Lookups accept
+the bare analysis name (`binary`) or Hipcheck's published, publisher-prefixed
+form (`mitre/binary`). `NIST-ID` is a `|`-delimited list.
+
+```typescript
+import {
+  getHipcheckNistControls,
+  hipcheckAnalysisExists,
+  getAllHipcheckAnalyses,
+} from '@mitre/hdf-mappings';
+
+const controls = getHipcheckNistControls('mitre/binary');
+// Returns: ['SI-7', 'SR-4']
+
+if (hipcheckAnalysisExists('typo')) { /* ... */ }
+
+const analyses = getAllHipcheckAnalyses();
+// Returns the 9 mapped Hipcheck analysis names, sorted
+```
+
+> **Provenance.** Hipcheck publishes no analysis-to-controls crosswalk, so this
+> table is a hand-curated, NIST-RMF-reviewed mapping — each row carries a
+> `Rationale`. It is the single source of truth in
+> `scripts/generate-hipcheck-mappings.mjs`, which writes both the Go and TS
+> copies byte-identically (`--check` gates drift in CI). As with the other
+> mappings, these are candidate control associations for triage, not evidence a
+> control is assessed or satisfied.
+
 ## Go API
 
 Each mapping is also available as a Go package:
@@ -218,6 +268,7 @@ hdf-mappings/go/
   owasp/      — OWASP→NIST lookups (NISTControls)
   nessus/     — Nessus plugin→NIST lookups (NISTControls, with family+pluginID)
   nikto/      — Nikto test→NIST lookups (NISTControls)
+  hipcheck/   — Hipcheck analysis→NIST lookups (NISTControls, Exists, AllAnalyses)
   scoutsuite/ — ScoutSuite rule→NIST lookups (NISTControls)
   awsconfig/  — AWS Config→NIST lookups (NISTControls, GetByRuleName, GetByIdentifier)
 ```
@@ -261,7 +312,7 @@ mapping   = awsconfig.GetByRuleName("secretsmanager-scheduled-rotation-success-c
 | Nessus→NIST | heimdall2 mapping tables |
 | Nikto→NIST | heimdall2 mapping tables |
 | ScoutSuite→NIST | heimdall2 mapping tables |
-| AWS Config→NIST | heimdall2 mapping tables |
+| AWS Config→NIST | AWS Config OBP for NIST 800-53 docs + Security Hub NIST r5 standard + derived (see Coverage tiers) |
 
 ## License
 

package/dist/index.d.ts

@@ -213,6 +213,8 @@ declare const DEFAULT_STATIC_ANALYSIS_NIST_TAGS: string[];
 declare const DEFAULT_REMEDIATION_NIST_TAGS: string[];
 /** Dependency/inventory management tools (CM-8). */
 declare const DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS: string[];
+/** Configuration-compliance checks with no specific mapping (CM-6: Configuration Settings). */
+declare const DEFAULT_CONFIG_MANAGEMENT_NIST_TAGS: string[];
 //#endregion
 //#region src/owasp/types.d.ts
 /**
@@ -492,5 +494,31 @@ declare function awsConfigMappedRevisions(identifier: string, ruleName: string):
 /** Get all AWS Config to NIST mappings (all revisions). */
 declare function getAllAwsConfigMappings(): AwsConfigNistMappings;
 //#endregion
-export { type AwsConfigNistMapping, type AwsConfigNistMappings, type CCIItem, type CCIMappings, type CweNistMapping, type CweNistMappings, DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_NIST_REVISION, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, type NISTDescriptions, type NessusNistMapping, type NessusNistMappings, type NiktoNistMappings, type NistCCIMappings, type OwaspNistMapping, type OwaspNistMappings, SUPPORTED_NIST_REVISIONS, type ScoutsuiteNistMapping, type ScoutsuiteNistMappings, awsConfigIdentifierExists, awsConfigMappedRevisions, awsConfigRuleNameExists, cciExists, cweExists, getAllAwsConfigIdentifiers, getAllAwsConfigMappings, getAllAwsConfigRuleNames, getAllCCIIds, getAllCweIds, getAllCweMappings, getAllNISTIds, getAllNessusMappings, getAllNessusPluginFamilies, getAllNiktoIds, getAllNiktoMappings, getAllOwaspIds, getAllOwaspMappings, getAllScoutsuiteMappings, getAllScoutsuiteRules, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getAwsConfigNistControlsBySubstring, getAwsConfigNistMappingByIdentifier, getAwsConfigNistMappingByName, getCCIDescription, getCCINistMappings, getCurrentNistRevision, getCweName, getCweNistControl, getCweNistMapping, getNISTDescription, getNISTFamily, getNessusNistControl, getNessusPluginFamilyMappings, getNiktoNistControl, getNistCCIMappings, getOwaspName, getOwaspNistControl, getOwaspNistMapping, getScoutsuiteNistControl, getScoutsuiteNistMapping, isNistStrict, nessusPluginFamilyExists, niktoExists, nistExists, nistToCci, owaspExists, resetNistRevision, scoutsuiteRuleExists, setCurrentNistRevision, setNistStrict };
+//#region src/hipcheck/types.d.ts
+/**
+ * TypeScript types for Hipcheck analysis to NIST 800-53 mappings.
+ */
+interface HipcheckNistMapping {
+  Analysis: string;
+  'NIST-ID': string;
+  Rev: number;
+  Rationale: string;
+}
+type HipcheckNistMappings = HipcheckNistMapping[];
+//#endregion
+//#region src/hipcheck/index.d.ts
+/**
+ * Get the NIST 800-53 controls for a Hipcheck analysis name.
+ * Accepts bare ("binary") or publisher-prefixed ("mitre/binary") names.
+ * @returns array of control IDs, or [] if the analysis has no mapping
+ */
+declare function getHipcheckNistControls(analysis: string): string[];
+/** Check whether a Hipcheck analysis name has a NIST mapping. */
+declare function hipcheckAnalysisExists(analysis: string): boolean;
+/** Get all mapped Hipcheck analysis names, sorted. */
+declare function getAllHipcheckAnalyses(): string[];
+/** Get all Hipcheck to NIST mappings. */
+declare function getAllHipcheckMappings(): HipcheckNistMappings;
+//#endregion
+export { type AwsConfigNistMapping, type AwsConfigNistMappings, type CCIItem, type CCIMappings, type CweNistMapping, type CweNistMappings, DEFAULT_COMPONENT_MANAGEMENT_NIST_TAGS, DEFAULT_CONFIG_MANAGEMENT_NIST_TAGS, DEFAULT_NIST_REVISION, DEFAULT_REMEDIATION_NIST_TAGS, DEFAULT_STATIC_ANALYSIS_NIST_TAGS, type HipcheckNistMapping, type HipcheckNistMappings, type NISTDescriptions, type NessusNistMapping, type NessusNistMappings, type NiktoNistMappings, type NistCCIMappings, type OwaspNistMapping, type OwaspNistMappings, SUPPORTED_NIST_REVISIONS, type ScoutsuiteNistMapping, type ScoutsuiteNistMappings, awsConfigIdentifierExists, awsConfigMappedRevisions, awsConfigRuleNameExists, cciExists, cweExists, getAllAwsConfigIdentifiers, getAllAwsConfigMappings, getAllAwsConfigRuleNames, getAllCCIIds, getAllCweIds, getAllCweMappings, getAllHipcheckAnalyses, getAllHipcheckMappings, getAllNISTIds, getAllNessusMappings, getAllNessusPluginFamilies, getAllNiktoIds, getAllNiktoMappings, getAllOwaspIds, getAllOwaspMappings, getAllScoutsuiteMappings, getAllScoutsuiteRules, getAwsConfigNistControlByIdentifier, getAwsConfigNistControlByName, getAwsConfigNistControlsBySubstring, getAwsConfigNistMappingByIdentifier, getAwsConfigNistMappingByName, getCCIDescription, getCCINistMappings, getCurrentNistRevision, getCweName, getCweNistControl, getCweNistMapping, getHipcheckNistControls, getNISTDescription, getNISTFamily, getNessusNistControl, getNessusPluginFamilyMappings, getNiktoNistControl, getNistCCIMappings, getOwaspName, getOwaspNistControl, getOwaspNistMapping, getScoutsuiteNistControl, getScoutsuiteNistMapping, hipcheckAnalysisExists, isNistStrict, nessusPluginFamilyExists, niktoExists, nistExists, nistToCci, owaspExists, resetNistRevision, scoutsuiteRuleExists, setCurrentNistRevision, setNistStrict };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/cci/types.ts","../src/cci/index.ts","../src/nist/types.ts","../src/nist/index.ts","../src/owasp/types.ts","../src/owasp/index.ts","../src/cwe/types.ts","../src/cwe/index.ts","../src/nessus/types.ts","../src/nessus/index.ts","../src/nikto/types.ts","../src/nikto/index.ts","../src/scoutsuite/types.ts","../src/scoutsuite/index.ts","../src/awsconfig/types.ts","../src/awsconfig/index.ts"],"mappings":";;;;UAGiB;;EAEf;;EAEA;;;;;KAMU,cAAc,eAAe;;;;;KAM7B,kBAAkB;;;;;;;;;;;;;;;;;;iBCId,kBAAkB;;;;;;;;;;;;;iBAqBlB,mBAAmB;;;;;;;;;;;;iBAoBnB;;;;;;;;;;;;;;iBAiBA,UAAU;;;;;;;;;;;;;;iBA8BV,mBAAmB;;;;;;;;;;;;;;iBAqBnB,UAAU;;;;;;KCjId,mBAAmB;;;;;;;;;;;;;;;;cCiBlB;;cAGA;;iBAKG;;;;;iBAQA,uBAAuB;;iBAUvB;;iBAOA;;;;;;iBASA,cAAc;;;;;;;;;;;;;iBAgBd,mBAAmB;;;;;;;;;;;;iBAmBnB;;;;;;;;;;;;;;iBAiBA,WAAW;;;;;;;;;;;;;;;;iBAuBX,cAAc;;;;;;;;;;;cAgCjB;;cAGA;;cAGA;;;;;;UC3KI;EACf;EACA;EACA;EACA;EACA;;KAGU,oBAAoB;;;;;;;;;;;;;;;iBCYhB,oBAAoB,kBAAkB;;;;;;;;;;;;;iBAoBtC,oBAAoB;;;;;;;;;;;;;iBAiBpB,aAAa;;;;;;;;;;;;iBAgBb;;;;;;;;;;;;;;iBAiBA,YAAY;;;;;;;;;;;;iBAmBZ,uBAAuB;;;;;;UC7GtB;EACf;EACA;EACA;EACA;EACA;;KAGU,kBAAkB;;;;iBCiBd,kBACd,eACA,eACC;;iBAKa,kBAAkB,eAAe;;iBAKjC,WAAW,eAAe;;iBAK1B,aAAa;;iBAKb,UAAU,eAAe;;iBAKzB,qBAAqB;;;;;;UCrDpB;EACf;EACA;EACA;;KAGU,qBAAqB;;;;;;;;;iBCKjB,qBACd,sBACA;;;;;;iBAwBc,8BACd,uBACC;;;;;iBAQa;;;;;;iBAUA,yBAAyB;;;;;iBAQzB,wBAAwB;;;;;;KCjE5B,oBAAoB;;;;;;;;iBCUhB,oBAAoB;;;;;iBASpB;;;;;;iBASA,YAAY;;;;;iBASZ,uBAAuB;;;;;;UCrCtB;EACf;EACA;;KAGU,yBAAyB;;;;;;;;iBCQrB,yBAAyB,eAAe;;;;;;iBASxC,yBAAyB;;;;;iBASzB;;;;;;iBASA,qBAAqB;;;;;iBAQrB,4BAA4B;;;;;;UChD3B;EACf;EACA;EACA;EACA;;KAGU,wBAAwB;;;;iBCsBpB,oCACd,oBACA,eACC;;iBAKa,8BACd,kBACA,eACC;;iBAKa,oCACd,oBACA;;iBAMc,8BACd,kBACA;;;;;;;iBAWc,oCACd,cACA;;iBAoBc,2BAA2B;;iBAK3B,yBAAyB;;iBAKzB,0BAA0B,oBAAoB;;iBAK9C,wBAAwB,kBAAkB;;;;;;;;iBAW1C,yBAAyB,oBAAoB;;iBAa7C,2BAA2B"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/cci/types.ts","../src/cci/index.ts","../src/nist/types.ts","../src/nist/index.ts","../src/owasp/types.ts","../src/owasp/index.ts","../src/cwe/types.ts","../src/cwe/index.ts","../src/nessus/types.ts","../src/nessus/index.ts","../src/nikto/types.ts","../src/nikto/index.ts","../src/scoutsuite/types.ts","../src/scoutsuite/index.ts","../src/awsconfig/types.ts","../src/awsconfig/index.ts","../src/hipcheck/types.ts","../src/hipcheck/index.ts"],"mappings":";;;;UAGiB;;EAEf;;EAEA;;;;;KAMU,cAAc,eAAe;;;;;KAM7B,kBAAkB;;;;;;;;;;;;;;;;;;iBCId,kBAAkB;;;;;;;;;;;;;iBAqBlB,mBAAmB;;;;;;;;;;;;iBAoBnB;;;;;;;;;;;;;;iBAiBA,UAAU;;;;;;;;;;;;;;iBA8BV,mBAAmB;;;;;;;;;;;;;;iBAqBnB,UAAU;;;;;;KCjId,mBAAmB;;;;;;;;;;;;;;;;cCiBlB;;cAGA;;iBAKG;;;;;iBAQA,uBAAuB;;iBAUvB;;iBAOA;;;;;;iBASA,cAAc;;;;;;;;;;;;;iBAgBd,mBAAmB;;;;;;;;;;;;iBAmBnB;;;;;;;;;;;;;;iBAiBA,WAAW;;;;;;;;;;;;;;;;iBAuBX,cAAc;;;;;;;;;;;cAgCjB;;cAGA;;cAGA;;cAGA;;;;;;UC9KI;EACf;EACA;EACA;EACA;EACA;;KAGU,oBAAoB;;;;;;;;;;;;;;;iBCYhB,oBAAoB,kBAAkB;;;;;;;;;;;;;iBAoBtC,oBAAoB;;;;;;;;;;;;;iBAiBpB,aAAa;;;;;;;;;;;;iBAgBb;;;;;;;;;;;;;;iBAiBA,YAAY;;;;;;;;;;;;iBAmBZ,uBAAuB;;;;;;UC7GtB;EACf;EACA;EACA;EACA;EACA;;KAGU,kBAAkB;;;;iBCiBd,kBACd,eACA,eACC;;iBAKa,kBAAkB,eAAe;;iBAKjC,WAAW,eAAe;;iBAK1B,aAAa;;iBAKb,UAAU,eAAe;;iBAKzB,qBAAqB;;;;;;UCrDpB;EACf;EACA;EACA;;KAGU,qBAAqB;;;;;;;;;iBCKjB,qBACd,sBACA;;;;;;iBAwBc,8BACd,uBACC;;;;;iBAQa;;;;;;iBAUA,yBAAyB;;;;;iBAQzB,wBAAwB;;;;;;KCjE5B,oBAAoB;;;;;;;;iBCUhB,oBAAoB;;;;;iBASpB;;;;;;iBASA,YAAY;;;;;iBASZ,uBAAuB;;;;;;UCrCtB;EACf;EACA;;KAGU,yBAAyB;;;;;;;;iBCQrB,yBAAyB,eAAe;;;;;;iBASxC,yBAAyB;;;;;iBASzB;;;;;;iBASA,qBAAqB;;;;;iBAQrB,4BAA4B;;;;;;UChD3B;EACf;EACA;EACA;EACA;;KAGU,wBAAwB;;;;iBCsBpB,oCACd,oBACA,eACC;;iBAKa,8BACd,kBACA,eACC;;iBAKa,oCACd,oBACA;;iBAMc,8BACd,kBACA;;;;;;;iBAWc,oCACd,cACA;;iBAoBc,2BAA2B;;iBAK3B,yBAAyB;;iBAKzB,0BAA0B,oBAAoB;;iBAK9C,wBAAwB,kBAAkB;;;;;;;;iBAW1C,yBAAyB,oBAAoB;;iBAa7C,2BAA2B;;;;;;UC/H1B;EACf;EACA;EACA;EACA;;KAGU,uBAAuB;;;;;;;;iBCqBnB,wBAAwB;;iBAUxB,uBAAuB;;iBAKvB;;iBAKA,0BAA0B"}