Xylok
Features
Integrated Knowledge Base
View the contents of the latest STIGs and other benchmarks right within Xylok, without needing to install Java and the DISA STIG Viewer. Plus, easily follow a check's associated CCIs and RMF controls to read what NIST says about that requirement.
This benchmark browser is freely available online.
Read what NIST says about particular controls directly in Xylok Scanner, and see what controls and CCIs are associated. Further down this page you can also see every benchmark check that fullfills this control.
This RMF/CCI browser is freely available online.
DISA puts out new versions of STIGs frequently. Using Xylok's integrated benchmark comparison, you can identify the changes you need to apply to meet the latest requirements.
Data Collection
You and your team are probably building standalone scripts to check items existing tools miss. Over time, these always become unmaintained and out of date. Instead, Xylok staff maintains the commands for all the benchmarks you use. As needed, you can always review the commands the Xylok-generated scripts are going to run.
For a baselined system, installing anything poses a problem. Xylok Scanner avoids this by doing data collection through human-readable command line scripts customized to each device.
Easily verify the data being extracted from your system. No messy XML or proprietary formats.
Analysis
Testing is easier when you can get to everything at once. When you're looking through results, we show you everything you need to know: the benchmark information, finding status, what command was used to check, the output of that command, previous scans of this same check, and more.
Xylok offers the ability to see changes between machines and on a single machine. If a setting changes from one scan to the next, the Xylok Scanner will let you view a diff of the exact output integrated right into your analysis.
Xylok makes it easy to view what's changed and what still needs work. Get a list of everything that needs your attention in seconds.
If nothing changed, you shouldn't need to repeat work. Mark a given result one time and from then on Xylok can apply that same status to any matching results. This applies to scans over time (i.e., you scanned the same machine last month and this month) and across machines (i.e., you have two devices which should be the same).
Xylok's internal post-processing cleans up the raw data received from your system and makes it easier to review. For some benchmarks, post-processing will recommend if the check is compliant or non-compliant with an applicable comment. The raw results are always one click away if needed.
Give some context on why you rated an item a finding and what it means for your particular system. No longer hope that you remember to write that down for your report or eMASS entry: we'll include your comments when we create the eMASS spreadsheet for you.
Reporting
Xylok can generate a Security Assessment Report spreadsheet, summarizing all of the data on your system. The format used is S3/6-accepted and is used by Xylok in their ASCA role. Many other reports are available and custom reports can be requested.
Xylok combines your technical findings and non-technical control requirements in one spot. Xylok's CCI Rater allows risk-rating every applicable CCI for your system, combining policy/procedure with benchmark findings. Other Xylok raters can then roll that information up further into RMF controls and POA&M items. All of these are tracked over time, allowing you to quickly review progress on your system. Xylok can generate a Security Assessment Report spreadsheet, summarizing all of the data on your system. The format used is S3/6-accepted and is used by Xylok in their ASCA role.
If you're a DoD organization, you need to import your results into eMASS. We make that a single click in Xylok Scanner. Don't waste hours just shifting data around.
Reports in Xylok let you see all your outstanding findings across the whole network, a specific site, or a specific machine. Help your engineers focus on fixing the most important items.
Quickly compare two devices or two scans to see the complete picture of what's changed on a compliance status or individual benchmark check level.