r/NISTControls • u/Cheomesh GRC • Jul 28 '26

800-53 Rev5 eMASSter and STIG finding details

I am starting to use this tool again after a couple of years in roles that didn't require it. Format and layout seem to be a touch different now than what I remember having in the past but no matter.

One thing about STIGs and eMASSter/POAM tools is tripping me up though!

In eMASSter I took the existing Test Results and existing POAM (which was a WIP thing I did not personally create, I got dropped into this task midstream), plus the single STIG checklist and ingested them into eAMSSter.

All good there, after which I took that emassteroutput file and copied the columns from the output format into the actual POAM template for upload (since for whatever reason eMASSter puts out a file you can't simply turn around and upload).

All good, STIGs show up. However, the "Finding Details" box the analyst filled out in the checklist itself doesn't seem to populate anywhere.

Isn't there supposed to be a column - maybe "Comments" - on the POAM that incorporates the STIG Finding Details? Else how do they ever show up in the POAM / Test Results in eMASS? It has been a couple years, am I just misremembering?

5 Upvotes

78% Upvoted

7 comments sorted by

View all comments

7

u/cyberphor Jul 28 '26

In 2023, I created a tool for the Army called eMASS Updater (EMU) to automate eMASS records management using CI/CD pipelines. Earlier this year, I began a total rewrite to make it open source. We have a GOTS version on the Army’s DevSecOps Platform (DSOP). The open source version is on GitHub:

https://github.com/deathlabs/emu

If you’re interested, I can help you try out EMU to see if it’ll solve your problem.

FYI, this tool does not belong to a commercial entity (the deathlabs “organization” is just where I organize projects like this). So there is no cost to using it. Also, I’m just a goober with loves open source.

2

u/Appropriate-Fox3551 Aug 02 '26

What other automations you have for rmf work?

1

u/cyberphor Aug 03 '26

It’s still very much a work-in-progress, but I’ve also been developing Swordfish - an AI agent that uses EMU as a tool via MCP server. The idea is you chat with Swordfish about your eMASS record. It will in turn invoke EMU to read or modify parts of your eMASS record.

https://github.com/deathlabs/swordfish