Preferred Approach
Component-based Representation
<!-system-security-plan:
uuid: 11111111-2222-4000-8000-000000000000
system-implementation:
components:
- cutuuid: 11111111-2222-4000-8000-009000300100
type: software
title: Database Sample
description: None
props:
- name: asset-type
value: database
-> <system-implementation>name: <componentfunction
uuid="uuid-value"value: type="software">see-remarks
<propremarks: name="virtual"Briefly value="no"/>describe <propthe name="software-name"function value="software-name"/>of <propthe name="version"database
value="V- 0.0.0"/>name: <propallows-authenticated-scan
name="asset-type"value: value="operating-system"/>'yes'
<prop- name="vendor-name"name: value="Vendorscan-type
Name"/>ns: <prop name="model" value="Model Number"/>
<prop name="patch-level" value="Patch-Level"/>
<prop name="scan-type" ns="http://fedramp.gov/ns/oscal"oscal
value="infrastructure"value: database
- name: vendor-name
ns: http:/>/fedramp.gov/ns/oscal
<propvalue: name="Small Biz Software, LLC
links:
- href: '#11111111-2222-4000-8000-009000500006'
rel: used-by
- href: '#11111111-2222-4000-8000-009001400001'
rel: receives
- href: '#11111111-2222-4000-8000-009001400002'
rel: initiates
status:
state: operational
responsible-roles:
- role-id: administrator
party-uuids:
- 11111111-2222-4000-8000-004000000010
inventory-items:
- uuid: 11111111-2222-4000-8000-011000000002
description: Component Inventory Example
props:
- name: asset-id
value: unique-asset-ID-02
- name: ipv4-address
value: 10.2.2.2
- name: ipv6-address
value: 0000:0000:0000:0000:0000:ffff:0a02:0202
- name: mac-address
value: 00:00:00:00:00:00
- name: asset-type
value: appliance
- name: virtual
value: 'no'
- name: public
value: 'no'
- name: fqdn
value: dns.name
- name: uri
value: uniform.resource.locator
- name: netbios-name
value: netbios-name
- name: physical-location
value: Physical location of Asset
- name: allows-authenticated-scan"scan
value="no">value: <remarks><p>'no'
remarks: If no, explain why. If yes, omit remarksremark.
field.<- name: scan-type
ns: http:/p></remarks>fedramp.gov/ns/oscal
</prop>value: <propinfrastructure
name="baseline-configuration-name"links:
value="Baseline- Config.href: Name"'#11111111-2222-4000-8000-001000000059'
/>rel: <propbaseline
name="function"responsible-parties:
value="Required brief, text-based description.">
<remarks><p>Optional, longer, formatted description.</p></remarks>
</prop>
<link rel="validation" href="#uuid-of-validation-component" />
<status state="operational"/>
<responsible-party- role-id="id: asset-owner">owner
<party-id>person-7</party-id>uuids:
</responsible-party>- <responsible-party11111111-2222-4000-8000-004000000010
- role-id="id: asset-administrator">administrator
<party-id>it-dept</party-id>uuids:
</responsible-party>
</component>
<!-- service,11111111-2222-4000-8000-004000000017
interconnectionimplemented-components:
- component-uuid: 11111111-2222-4000-8000-009000300100
props:
-> <system-inventory>name: <inventory-itemasset-id
uuid="uuid-value">value: <description><p>unique-asset-ID-3
remarks: 'COMMENTS: If needed, describeprovide this instance.</p></description>
<prop name="asset-id" value="unique-asset-id"/>
<prop name="ipv4-address" value="0.0.0.0"/>
<prop name="public" value="no"/>
<prop name="fqdn" value="example.com"/>
<prop name="uri" value="https://example/query?key=value#anchor"/>
<prop name="mac-address" value=">00:00:00:00:00:00"/>
<prop name="serial-number" value="Serial #"/>
<prop name="vlan-id" value="VLAN Identifier"/>
<prop name="network-id" value="Network Identifier"/>
<prop name="is-scanned" value="yes" />
<implemented-component component-uuid="component-uuid-value " />
<remarks><p>COMMENTS: Additionaladditional information about this inventory
item.</p></remarks>
</inventory-item>
<!-- Repeat the inventory-item assembly for each use of the above component -->
</system-inventory>
<!-- system-implementation remarks -->
</system-implementation>'
Notes:
- If component-sample is an image of a Linux virtual machine (VM), and 10 instances of that VM are in use, there would be one (1) component assembly and ten (10) inventory-item assemblies, all referencing the same component.
Inventory Data Locations and XPath Queries
The following queries are intended to show where to find each piece of information within the system inventory template.
XPath Queries
Number of Inventory Items:
count(/*/system-implementation/system-inventory/inventory-item)
Number of Hardware Components:
count(/*/system-implementation/component[@type="hardware"])
Number of Software Components:
count(/*/system-implementation/component[@type="software"])
In Latest Scan?:
/*/system-implementation/system-inventory/inventory-item[1]/prop[@name="is-scanned"]/@value
List Inventory Items Not Scanned:
/*/system-implementation/system-inventory/inventory-item/prop[@name="is-scanned"][@value='no']/../prop[@name='ipv4-address']
List of Reasons Inventory Items Were Not Scanned:
/*/system-implementation/system-inventory/inventory-item/prop[@name="is-scanned"][@value='no']/remarks/node()
Unlike most XPath 2.0 queries in this document, the following queries cannot be easily converted to XPath 1.0. If working with XPath 1.0, it may be necessary to perform each search with two separate queries. These queries will list all the IPv4 addresses for each scan type (infrastructure, web, and database), whether using the flat-file inventory approach or the component-based approach.
XPath Queries
IPv4 Address of All Inventory Items Identified for Infrastructure Scanning:
distinct-values( (let $key:=/*/system-implementation/component[prop [@name='scan-type'] [@ns='http://fedramp.gov/ns/oscal']='infrastructure']/@uuid return /*/system-implementation/system-inventory/inventory-item [implemented-component/@component-uuid=$key]/ prop[@name='ipv4-address']) | (/*/system-implementation/system-inventory/inventory-item/prop[@name='ipv4-address'][../prop[@name='scan-type'][@ns='http://fedramp.gov/ns/oscal'] [string(.)='infrastructure']]) )
IPv4 Address of All Inventory Items Identified for Web Scanning:
distinct-values( (let $key:=/*/system-implementation/component[prop[@name='scan-type'][@ns='http://fedramp.gov/ns/oscal']='web']/@uuid return /*/system-implementation/system-inventory/inventory-item [implemented-component/@component-uuid=$key]/prop[@name='ipv4-address']) | (/*/system-implementation/system-inventory/inventory-item/prop[@name='ipv4-address'][../prop[@name='scan-type'][@ns='http://fedramp.gov/ns/oscal'][string(.)='web']]))
IPv4 Address of All Inventory Items Identified for Database Scanning:
distinct-values( (let $key:=/*/system-implementation/component[prop [@name='scan-type'] [@ns='http://fedramp.gov/ns/oscal']='database']/@uuid return /*/system-implementation/system-inventory/inventory-item [implemented-component/@component-uuid=$key]/prop[@name='ipv4-address']) | (/*/system-implementation/system-inventory/inventory-item/prop[@name='ipv4-address'][../prop[@name='scan-type'][@ns='http://fedramp.gov/ns/oscal'][string(.)='database']]))
IPv4 Address of All Items Where an Authenticated Scan is Possible:
distinct-values( (/*/system-implementation/system-inventory/inventory-item/prop [@name='ipv4-address'][../prop[@name="allows-authenticated-scan"][@value='yes']] ) | (let $key:=/*/system-implementation/component[prop [@name='allows-authenticated-scan'][@value='yes']]/@uuid return /*/system-implementation/system-inventory/inventory-item [implemented-component/@component-uuid=$key]/prop[@name='ipv4-address']))
IPv4 Address of All Items Where an Authenticated Scan is Not Possible:
distinct-values( (/*/system-implementation/system-inventory/inventory-item/prop[@name='ipv4-address'][../prop[@name="allows-authenticated-scan"][@value='no']] ) | ( let $key:=/*/system-implementation/component[prop [@name='allows-authenticated-scan'][@value='no']]/@uuid return /*/system-implementation/system-inventory/inventory-item [implemented-component/@component-uuid=$key]/prop[@name='ipv4-address']) )
Authenticated Scan Justification (if Authenticate Scan is "no"):
/*/system-implementation/system-inventory/inventory-item/prop[@name="allows-authenticated-scan"][@value="no"]/remarks/node()
OR
/*/system-implementation/component/prop[@name="allows-authenticated-scan"] [@value="no"]/remarks/node()