Purpose/Use Case

[gmisura]

Let me start out by saying that this project is very cool.

I'm just a little confused as to some of the use cases it does/doesn't solve.

The default page being an upload seems to be weird. Apparently the focus is on visualizing the json produced by inspec. Fine. The save button after you've successfully uploaded 1 or more hdr json files is nice, but after that, it seems to lack any organization/user interface/use case for utilizing those saved results.

I guess (correctly) you can view /results/1,2,3 and pull up old saved results. But the numbers: 1,2,3 are rather meaningless.

The evaluate API is nice, but, again, you end up needing to go to /results/9 to see the result and you have no way to browse all of the results that are saved. Did I miss something in the docs?

[aaronlippold]

Happy to talk with you about it.

You have two deployment modes for Heimdall - Lite and Server. In server you have users, groups etc but that is only when the DB is turned on.

In lite mode you are in browser only and have to load data manually.

[gmisura]

I'm using Heimdall server with a db (via the helm chart install). I see users/groups. That's fine.

I'm comparing this to STIG Manager: https://github.com/NUWCDIVNPT/stig-manager
You login and it has an interface to manage collections, Assets, findings.
You can get a picture of your overall posture, narrow it down to a specific collection, asset, etc.

In Heimdall, the focus is on the files I just uploaded. There's no organization of the results over time, for an entire org, etc.

I just want to make sure I'm not missing any existing functionality in Heimdall. It's very well written, but seems like it is not meeting my needs (which is fine as it meets other people/groups/orgs needs).

I'm interested in where heimdall is headed.

[Amndeep7]

Hi @gmisura, within Heimdall the intent is for you to use groups, tags, and our filtering capabilities to look at security results. W/r to results over time, you can use the comparison view to see how your results have changed over successive scans. If you're interested in a more organizational perspective, then you will want to look into TIR which is the application we are developing in conjunction with Lockheed Martin.

[aaronlippold]

I'm using Heimdall server with a db (via the helm chart install). I see users/groups. That's fine.

I'm comparing this to STIG Manager: NUWCDIVNPT/stig-manager You login and it has an interface to manage collections, Assets, findings. You can get a picture of your overall posture, narrow it down to a specific collection, asset, etc.

In Heimdall, the focus is on the files I just uploaded. There's no organization of the results over time, for an entire org, etc.

I just want to make sure I'm not missing any existing functionality in Heimdall. It's very well written, but seems like it is not meeting my needs (which is fine as it meets other people/groups/orgs needs).

I'm interested in where heimdall is headed.

There is indeed organized grouping over time and team, system and time.

In Heimdall we do this via the groups and tags and then you can look at reesults or 'result or grouped sets' via those tags.

For the view over time, that is Heimdall's compare view.

Happy to get this you and do a bit of show and tell and then talk about your specific use cases and if you found a gap that we need to fill, that would be great as that is how Heimdall grows.

I developed Heimdall in active collaboration with multiple CISO, ISSMs, eMass users across the DOD, IC and DIB and we evolve it through that collaboration.

Looking forward to talking with you more and finding out if we can find a new capability that we can add to Heimdall to help your needs as well.

[aaronlippold]

I propose we setup a Zoom or Teams call and just walk through a few things directly.

[gmisura]

We've long since moved on.

I'm personally still curious if the DoD accepts Heimdall's results in an ATO/FedRAMP audit?

[aaronlippold]

Yes since heimdall can export CLK, CLKB, XCCDF Results, CSV etc they can be a part of your accreditation package.

I made sure Heimdall could export all formats supported by the other systems I was involved with while at DISA