XSL Transform to .audit Conversion

This topic explains how to build and use custom XSL transforms and convert them into .audit files.

Several compliance check plugins rely on auditing XML content, such as Palo Alto, VMware, and Unix compliance checks. To take advantage of these capabilities, you should become familiar with creating XSL transforms. In some cases, building an XSL transform requires trial and error. Once you are familiar with that process, you can convert the transform into an .audit file.

Several audit checks (for example, AUDIT_XML, AUDIT_VCENTER, AUDIT_ESX) are separate and distinct, but use the same underlying logic. Understanding the fundamentals of working with XML allows you to translate them directly to other platforms that use XML.

By using the xsltproc utility, you can follow these steps to generate custom .audit files for XML content:

Install xsltproc

Verify xsltproc is installed on your system, or install it if needed. You can verify it is installed and works by entering the following command:

Identify the XML File to Use

Determine the XML file you are going to use. Verify the location of the file, and that it is XML content. For example:

Create the XSLT Transform

The goal is to extract relevant data from an XML file using XSL transforms. Start by creating an XSL transform. For example, assume you need to extract the “name” element from an XML file. The following XSLT extracts the required information:

Once the XSLT is created, save it in a convenient place for testing in the next step. This example can be saved as pa.xsl.

When using a custom XSLT in an .audit, ignore the first three lines and the last two lines. The Tenable Nessus plugin nbin adds those standard lines during processing. In this example, lines 5-8 are the lines to use in the AUDIT_XML or AUDIT_REPORTS item.

The testing process in step 5 can also be used while building the XSLT to validate assumptions or new techniques. This process is especially useful if you are new to XSLT or working on more complex transforms.

Test the XSLT Transform

Verify your XSL Transform works with xsltproc. The general format for testing is:

Plugging in the sample file names from the steps above returns the following output, which confirms that the XSL transform is correct and properly formatted and that the expected data is returned.

Copy the XSLT to the .audit File

Once the XSL Transform works as intended, copy the XSLT lines of interest (lines 5-8 in this example) to the .audit check.

Each line of the custom XSL transform must be placed into its own xsl_stmt element enclosed in double quotes. Because the xsl_stmt element uses double quotes to encapsulate the <xsl> statements, any double quotes within must be escaped.

Note: Escaping the double quotes is important and not doing so risks errors in check execution.

In the next step you can see several examples of properly escaped double quotes.

Perform the Audit

Once the first five steps are complete, you have everything required to construct an audit: