Add an option to view a description of rules when creating a tailored baseline #237

New Issue

michael · 2026-01-19T18:29:45Z

michael commented

2026-01-19 18:29:45 +00:00

Originally created by @seanbalsiger on GitHub.

Originally assigned to: @brodjieski on GitHub.

Problem to solve

When generating a tailored baseline, it can be difficult to tell what the rule will do based off of the rule name. It would be convenient to be able to view the full description of rules when needed.

Intended users

Users responsible for creating the tailored baseline that will be implemented by their organization.

Further details

The use case would be that you (and hopefully some colleagues) are using the generate_baseline.py script to create a tailored baseline for your org. You aren't familiar enough with the rules to understand what is being included or excluded based solely off of the rule titles so you have to hunt through the rules directory to read descriptions of some rules and inform your decisions. If there were an option to view the full description of each rule as needed, it could save time and make the process smoother for everyone involved.

Proposal

Add a "d" option to display a full description when asked whether a rule should be included in your benchmark. Today, those lines look like this: "Would you like to include the rule for "audit_acls_files_configure" in your benchmark? [Y/n/all]" I would propose changing the options to "[Y/n/all/d]" where d will print the rule description.

Documentation

When generating a tailored baseline, the user is presented some instructions that includes this line: "You will be prompted to include each rule, and for those with specific organizational defined values (ODV), you will be prompted for those as well."

I propose amending that to include definitions of all options like this:"
Y = yes
n = no
all = include all rules and skip ahead to ODV values
d = display a full description of the rule"

Testing

This suggestion poses no major risks to the project.

It would improve the quality of the product by making it easier for new users to generate tailored baselines.

Recommended testing is to generate a tailored baseline using all_rules and selecting the "d" option for each rule to ensure the descriptions display properly.

What does success look like, and how can we measure that?

Success and acceptance criteria would be being able to view the description of every rule while generating a tailored baseline.

Links / references

N/A

Originally created by @seanbalsiger on GitHub. Originally assigned to: @brodjieski on GitHub. ### Problem to solve When generating a tailored baseline, it can be difficult to tell what the rule will do based off of the rule name. It would be convenient to be able to view the full description of rules when needed. ### Intended users Users responsible for creating the tailored baseline that will be implemented by their organization. ### Further details The use case would be that you (and hopefully some colleagues) are using the generate_baseline.py script to create a tailored baseline for your org. You aren't familiar enough with the rules to understand what is being included or excluded based solely off of the rule titles so you have to hunt through the rules directory to read descriptions of some rules and inform your decisions. If there were an option to view the full description of each rule as needed, it could save time and make the process smoother for everyone involved. ### Proposal Add a "d" option to display a full description when asked whether a rule should be included in your benchmark. Today, those lines look like this: "Would you like to include the rule for "audit_acls_files_configure" in your benchmark? [Y/n/all]" I would propose changing the options to "[Y/n/all/d]" where d will print the rule description. ### Documentation When generating a tailored baseline, the user is presented some instructions that includes this line: "You will be prompted to include each rule, and for those with specific organizational defined values (ODV), you will be prompted for those as well." I propose amending that to include definitions of all options like this:" Y = yes n = no all = include all rules and skip ahead to ODV values d = display a full description of the rule" ### Testing This suggestion poses no major risks to the project. It would improve the quality of the product by making it easier for new users to generate tailored baselines. Recommended testing is to generate a tailored baseline using all_rules and selecting the "d" option for each rule to ensure the descriptions display properly. ### What does success look like, and how can we measure that?  Success and acceptance criteria would be being able to view the description of every rule while generating a tailored baseline. ### Links / references N/A

michael closed this issue

2026-01-19 18:29:45 +00:00

michael commented

2026-01-19 18:29:46 +00:00

@brodjieski commented on GitHub:

Added an option to enter a "?" during the process, which will display the rule information.

@brodjieski commented on GitHub: Added an option to enter a "?" during the process, which will display the rule information.

michael commented

2026-01-19 18:29:46 +00:00

@golbiga commented on GitHub:

This has been merged into all of the os branches. It will be merged into main during the ventura release

@golbiga commented on GitHub: This has been merged into all of the os branches. It will be merged into main during the ventura release

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#237